# A Highly Interactive Honeypot-Based Approach to Network Threat Management
## 2 Survey of Existing Network Threat Management Methods
### Tempting Comparison
In the event of any identified abnormal or harmful data transfer behaviors, this device can swiftly interrupt, adjust, or isolate such actions to prevent potential damage or compromise. A vulnerability scanner is a hardware device used to scan vulnerabilities in an enterprise network. Traditional vulnerability scanners have a program inside the hardware that automatically detects weak points in remote or local host security. However, the vulnerability scanner provided by QualysGuard based on the SaaS cloud service architecture is simply a tool for collecting various system situation data for comparison with vulnerability data in the Qualys terminal SOC to confirm the system status. Due to the original intention of the design, both intrusion prevention systems and vulnerability scanners are not attractive. Compared to several of the aforementioned network threat management methods, medium- and low-interactivity honeypots are somewhat tempting [1]. In the same vein, Dionaea and Cowrie are used here as examples. Dionaea is a honeypot that has been designed to be minimally interactive, allowing attackers to target simulated systems and services that do not represent real product systems. The purpose of the honeypot is to expose the vulnerabilities and targets that attackers may exploit, without risking the security of actual systems. This design makes the honeypot easy to install and configure, and the honeypot system has almost no security risks, but imperfect simulations can reduce the ability to capture data and be easily recognized by attackers and lose effectiveness when faced with increasingly mature honeypot recognition technology. Cowrie, as an open-source low-to-medium interactive honeypot system, mainly simulates a real SSH and Telnet server to collect information about attackers. Like Dionaea, this system also encounters a similar problem. While it may have some degree of allure to attackers, it can be readily detected with the advent of increasingly sophisticated honeypot identification technologies. As a result, the system fails to achieve its intended objectives and instead consumes valuable system resources, thereby inflating network defense costs. Compared with traditional defense technologies, medium- and low-interaction honeypots have a certain temptation, but they are gradually unable to meet the demand and are only suitable for specific environments. High-interaction honeypots are similar to real systems in that they can be completely compromised, allowing the attacker to gain full access to the system and use it as a stepping stone to launch further network attacks. Although the deception of the honeypot is increased and better able to attract hackers, if a hacker with a higher technical capability invades the site and controls the system, it will completely expose the network environment that should be protected, posing a huge security risk. In summary, traditional access control and authentication systems, intrusion detection systems, log auditing systems, intrusion prevention systems, and vulnerability scanners are not typically effective in utilizing deception defense techniques due to their lack of enticement. However, the technology and design principles employed in these systems can supplement deception defense techniques, enhancing the security of the boundary between revealing and concealing, thereby safeguarding target information and environments. While medium- and low-interaction honeypots may be initially tempting, their success rate will likely decrease over time due to advancements in honeypot identification technology. On the other hand, high-interaction honeypots can be more seductive as they utilize actual services to deceive; however, they also entail unpredictable potential risks. High-interactivity and low-medium-interactivity honeypots each have their own areas of focus, with high-interactivity honeypots generally offering greater value for study.