# A Highly Interactive Honeypot-Based Approach to Network Threat Management
## 2 Survey of Existing Network Threat Management Methods
### Security Comparison  
The security of a network threat management system involves reinforcing network security protection measures to prevent breaches. This is achieved through technical means,such as setting up a highly deceptive target that entices attackers to launch attacks, thereby obtaining valuable information about them. Through the arrangement of security targets, it can effectively increase the cost of attackers and induce them to adopt the wrong attack methods and tools, thus protecting the organization's network, systems, applications, and other assets. Security is defensive and plays an important role in the network security protection system. It not only captures attackers through decoy targets but also enables detailed analysis of attackers through monitoring, traceability and other technologies to provide strong support for later protection. By applying security technologies, it prevents and avoids network attacks, data leakage, and other security threats, thus ensuring the safety of data and information of security targets. Simultaneously, the integration of interactivity and security in a network threat management system is crucial. Interactivity pertains to the system's interaction with the user and the extent of information available to them. A well-designed interactive system enables users to use the system more easily, leading to improved efficiency and security. Additionally, it facilitates the acquisition of detailed security information, enhancing the system's reliability. As such, the security and interactivity of a cyber threat management system work in tandem to determine the system's security and efficiency. There are many network threat management systems available in the market, including Honeyd, Dionaea, Kippo, Glastopf, Cowrie, Snort, etc. They have different implementations and are designed with different security architectures, which result in significant differences in terms of security. Honeyd is a small daemon that creates virtual hosts on a network. The hosts can be configured to run any service and can be adjusted to look like they are running specific operating systems. Honeyd allows a single host to declare multiple addresses for network simulation on the LAN. Honeyd improves network and self-security by providing threat detection and evaluation mechanisms. It also deters opponents by hiding real systems behind virtual systems. However, it is not designed with a CS architecture, which means that if the honeypot is compromised, the overall security of the system will be lost. Furthermore, Dionaea is a honeypot designed to emulate a server in order to capture the attacker's data. It supports multiple protocols such as HTTP, FIT, TFIP, etc. The primary objective of this activity is to detect malware that exploits vulnerabilities within the network's service offerings. The ultimate aim is to obtain a copy of the malware for analysis. Given that software that provides network services may contain exploitable vulnerabilities, it is reasonable to assume that dionaea, which also provides network services, may have such vulnerabilities as well. To mitigate potential security risks, dionaea is configured to operate without high privileges and to run within a chroot environment. However, to execute specific operations that require elevated privileges, dionaea creates a child process at startup that is authorized to run those operations after the privileges have been granted and subsequently removed. This does not guarantee anything, but it should be harder to get root access to the system from an unprivileged user in a chroot environment. However, this just hides the weakness deeper, and a malicious attacker can still get special privileges through dionaea. Kippo is a highly simulated low-interaction SSH honeypot, running as a daemon written in Twisted Conch, used to monitor data from attackers. Because it is a low-interaction honeypot, security is lacking.