# A Highly Interactive Honeypot-Based Approach to Network Threat Management
## 4 Implementation and Results Analysis of High Interactivity Honeypot System
### High Interaction Honeypot Implementation
This honeypot has many advantages. Firstly, by default, Shadow Daemon acts as a web application firewall and blocks malicious requests, but it is also designed to be used as a high-interactive honeypot. With a few simple modifications to the configuration file, the protection of the honeypot combined with the firewall can be disabled, allowing the system to remain hidden in the shadows. This modification increases the efficiency of the firewall and makes it harder for attackers to detect it as a honeypot, thus making it easier for the user to collect attack records. Additionally, the combination of the honeypot with the firewall is easy to operate and generates fewer errors in the collected data, making the data more authentic. It can be combined with other honeypot systems and integrated into a honeynet as an additional source of information [2]. However, the honeypot still has many disadvantages: first, the software itself is a firewall, and protection functions of the firewall need to be disabled for the honeypot to work normally. If the system does not have another firewall to protect it, the system is likely to crash and fail to achieve the purpose of the honeypot. Secondly, as a single honeypot, it lacks attraction to network attacks and attackers lack the motivation to attack. It needs to be combined with other honeypots to form a honeynet to effectively play its role. Finally, the configuration process of the honeypot is complex and there is a certain threshold for new users to use it. In response to the shortcomings of this honeypot, we have made corresponding improvements: we have separated the system firewall from the honeypot, so the honeypot does not need to close the firewall during operation and have securely authenticated the high-interaction honeypot through the central node, which issues authentication and registration information to the honeypot to ensure that the system is adequately protected while collecting data. Furthermore, we have streamlined the configuration process of the honeypot by implementing a more lucid and user-friendly client interface. This modification has resulted in a lowered barrier to entry for new users. Additionally, we have standardized the communication protocol between the honeypot and the central node, using a unified packet format that allows for effortless customization based on individual requirements. Finally, in response to the issue of weak attraction of this honeypot, we have strengthened its attraction as an individual honeypot by designing more enticing vulnerabilities, such as SQL injection vulnerabilities, and expanded its information acquisition scope. At the same time, we also adopted Ehoney as part of the system connecting to honeypots. Ehoney is the first open-source deception defense system from Seccome Teamer. It categorizes attacks into various phases, including reconnaissance, weapon development, payload delivery, vulnerability exploitation, implant deployment, ongoing control, and goal achievement. Moreover, the document outlines corresponding countermeasures to address each stage of the attack. The advantages of Ehoney are as follows: Firstly, it is business-oriented, has a simple and user-friendly operation method, and has a clear front-end, allowing for easy deployment and viewing of honeypot attack information with just simple operations. Secondly, Ehoney has comprehensive and detailed documentation, making improvement, communication and sharing easier, increasing the program's scalability. Furthermore, this honeypot can generate various secret signatures, meaning that the characteristics of some accessible network resources from certain types of files can be modified to generate a secret signature. When a hacker downloads a document or accesses a folder from an infiltrated server or honeypot, an alarm is triggered. Finally, Ehoney utilizes topology visualization technology to present attack views visually, rendering all attacks perceptible, and constructing a comprehensive attack chain.