# A Highly Interactive Honeypot-Based Approach to Network Threat Management
## 2 Survey of Existing Network Threat Management Methods
### Security Comparison
Furthermore, because it has fewer functions, the possibility of vulnerabilities in the system itself is relatively small, which increases Kippo's security in another dimension. Another attack point for Kippo is its daemon, which relies on Twisted Conch to write the daemon to self-reset and run, if the security of Twisted Conch is breached, the security of Kippo will also be affected. Glastopf is a web application honeypot that simulates a web application to capture data from attackers. Web applications, databases, and cross-site scripting vulnerabilities create a substantial attack surface that can be exploited for a variety of malicious purposes, including website destruction, spam email propagation, website bot program creation, and drive-by download attacks. Glastopf is a low-interaction honeypot that mimics vulnerable web servers hosting many web pages and web applications with thousands of vulnerabilities. Glastopf is easy to set up and receives thousands of attacks every day once it is indexed by search engines. Glastopf is a Python web application honeypot. Instead of vulnerability simulation, we use vulnerability-type simulation. Several common attack types are already established, including remote file inclusion through a built-in PHP sandbox, local file inclusion that provides access to files from a virtual file system, and HTML injection through POST requests. The security of Glastopf is not guaranteed due to its low interaction, but Glastopf has added a PHP sandbox to the security architecture, separating the program's runtime environment and program execution environment logic analysis, strengthening the overall security. Cowrie is an SSH and Telnet honeypot used to monitor data from attackers. Cowrie is a medium-high interaction SSH and Telnet honeypot designed to record brute force attacks and shell interactions performed by attackers. In the medium interaction mode (shell), it simulates a UNIX system in Python, and in the high interaction mode (proxy), it acts as an SSH and Telnet proxy to observe the attacker's behavior towards another system. It can be run either as a simulated shell or as a proxy for SSH and Telnet to another system. It provides a complete and available Docker environment, which allows for deployment environment and physical environment isolation [10]. The security depends on the relatively secure Docker environment. As a medium-high interaction system, Cowrie has relatively high security. Snort is a potent network intrusion detection system that surveils network traffic, identifying any attack behavior, and currently stands as the world's most significant open-source intrusion defense system (IPS). The Snort IPS uses a series of rules to help define malicious network activity and uses these rules to search for matching packets and generate alerts for users. Snort can also be deployed inline to block these packets. Snort has three main uses: as a packet sniffer (such as tcpdump), as a packet recorder--which is useful for network traffic debugging, or it can be used as a mature network intrusion defense system. Snort can be downloaded and configured for personal and business use. Unlike traditional honeypots, Snort has no disguise and relies on transparency to monitor real systems. From some perspectives, it has no security, it is merely an adjunct to the physical system and constantly checks for attack behavior. These network threat management methods each have their own features and are suitable for different network security purposes, creating a diverse security landscape. Although honeypots are an effective network security tool, they cannot completely replace other security measures such as firewalls and encryption. Only by combining with other security technologies can the system's security be increased.