# A Highly Interactive Honeypot-Based Approach to Network Threat Management
## 2 Survey of Existing Network Threat Management Methods
### Tempting Comparison  
The temptation index of a Network Threat Management System pertains to the specific targets established by the platform through technical means. These targets are designed to facilitate the attackers in identifying and recognizing valuable assets, thereby making them more susceptible to attacks. The main manifestation is attack deception defense technology, such as honeypots, honeynets, honey traps, honey markers, lures, deception defense platforms, mobile defense targets (MTD), and mimicry defense, etc. [9]. The technology aims to protect the organization's network, system, and application assets with the goal of security protection. It realizes the goals of obtaining attacker information, increasing attack difficulty, and sticky defense through the exposure of facts, hiding facts, exposing lies, and hiding lies, etc. It is a part of active defense and can use deception defense technology to build a trapping, monitoring, and tracing system. The establishment of tempting targets can effectively increase the cost of an attack, ensnare attackers by presenting them with counterfeit devices or services, and encourage the adoption of erroneous attack methodologies and tools. This approach represents a specific application of attack deception defense. Access control and authentication systems are designed to protect the confidentiality and non-repudiation of data. Based on authentication, access control technologies are applied to regulate the access scope of users or programs to resources and systems, ensuring that authorized users can use the system and data legally, and realizing controlled management of resources. At the same time, users cannot operate information outside of their own permission range. Due to the different design intentions, this system does not consider deception attacks, so it does not have enticement, but it can complement the network threat management system with deception defense technology, forming a multi-layered protection system. The intrusion detection system and log audit system detect intrusions or attempts on the system by inspecting network behavior, network logs, audit data, and other network information. They take action to block the intrusion based on preset rules. For example, the intrusion detection system in Qingteng Cloud Security has a multi-dimensional intrusion-sensing network and its core functions are divided into four modules: intrusion handling, real-time event monitoring, intrusion analysis, and real-time intrusion warnings. Different detection methods are used to respond to both ongoing and past intrusions. Graylog is an open-source log management system that receives logs through different input interfaces and provides a web access interface for users. It uses Elasticsearch to index and store logs and MongoDB to store configuration information. Log information enters Graylog through Inputs, passes through Extractors if log field extraction is set, then arrives in the Streams log stream, and finally is written to the specified Index based on the Streams log stream settings. Alarms are triggered based on the matching information set in the log stream. Similar to access control and authentication systems, the design purpose of these two systems is to promptly detect intrusions in the network environment and take countermeasures. Therefore, a single intrusion detection system or log audit system does not have the same level of appeal. However, its handling of intrusion information can effectively process information obtained from attacker deception defense techniques, increase defense reserves, and better respond to network attacks. An intrusion prevention system is a computer network security facility that supplements anti-virus software and firewalls. The network device under consideration functions as a monitoring mechanism that actively monitors the behavior of data transfer across networks or network devices.