# A Highly Interactive Honeypot-Based Approach to Network Threat Management
## 2 Survey of Existing Network Threat Management Methods
### Simplicity Comparison  
The simplicity of use of a network threat management system refers to the convenience of installing the system and the simplicity of operation for the user when performing network security activities. A system that is easy to use is more conducive to user operation and installation, thereby reducing the barriers to entry and having a significant impact on promoting and facilitating widespread usage. As an illustration of an intrusion detection system, we can take the well-known example of Snort. Snort has three modes: sniffer mode, packet logger mode, and network intrusion detection system mode. The sniffer mode only captures network packets and displays them on the terminal, the packet logger mode stores the captured packets to disk, and the intrusion detection mode is the most complex, which can analyze packets, detect them based on rules, and respond accordingly. Snort has many functions, such as packet sniffing, packet analysis, packet detection, response processing, etc. Each module implements different functions, and each module is integrated with Snort as a plug-in. The system framework adopts a modular approach, which is not only simple and easy to understand, but also easy to expand functionality and convenient for users to maintain. However, since Snort adopts a custom rule method to detect network intrusion in the intrusion detection mode, although this increases the system's flexibility, the detection of network intrusion behavior will be more accurate, the collected information is more diverse and comprehensive, but it also increases the cost of use and learning for Snort users. The command-line format used for rule definition and intrusion log function in this intrusion detection system somewhat undermines its simplicity. The intrusion prevention system is exemplified by the Controller Area Network Intrusion Prevention System Leveraging Fault Recovery method. Its specific implementation mechanism is divided into four parts: data reconstruction, protocol recognition and protocol parsing, feature matching, and response processing. Prior to entering the IPS, the data undergoes IP fragmentation and TCP stream reconstruction to ensure the continuity of the application layer data. The system then identifies the application layer protocol by analyzing its content and decodes it in detail according to the specific protocol. Furthermore, the system performs a thorough packet feature extraction. Finally, the parsed packet features and signatures are matched, and if the signature is hit, a response processing is performed [7]. On the whole, the IPS is simple in terms of user-friendliness and is easier to expand. However, expanding the intrusion defense feature library also leads to an increase in the system's maintenance costs. At the same time, the increase in system functionality also increases the complexity of the system framework and the cost of maintenance and use. The log auditing system, exemplified by Graylog, operates through a combination of various components, including Input, Extractors, Stream, and Index, with the latter being the most crucial. Input is a log data capture and acceptance component, while Extractors are log data format conversion components, allowing for log field conversions from different sources, such as converting Nginx status codes into English representations. Stream is a log information classification and grouping component, and Index is a data storage component. Converted data can be grouped into different Streams by different tag types, and these log data are stored in the specified Index database for persistent storage. In terms of simplicity, Graylog is similar to Snort and uses a modular approach, expanding its functionality with plugins. The framework is easy to understand and easy to expand. Graylog also provides a web interface with a web interface, which supports log data visualization and allows users to search and analyze log data, as well as customize rules. The flexible plugin system also enhances system availability.