# A Highly Interactive Honeypot-Based Approach to Network Threat Management
## 2 Survey of Existing Network Threat Management Methods
### Interactivity Comparison  
The interactivity of a network threat management system refers to the interaction mode and the breadth of information acquisition between the system and the security object. This includes the information acquisition method of the system, operation methods, degree of information acquisition, and the interaction mode between the user and the system, such as interface design, report generation, data visualization, etc. Good interactivity can help users more easily understand and use the system, improve the efficiency and effectiveness of the system, and also help the user to obtain more detailed information about the security object, further enhancing the reliability of the system. Compared to other network threat management methods, the interactivity of low to medium-interactivity honeypots is lower. For example, Dionaea and Cowrie: Dionaea is an open-source low to a medium interactivity honeypot system. It aims to simulate common network services to collect information about potential attackers and supports multiple protocols, including HTTP, FTP, SMTP, etc. Dionaea can collect information such as the remote host's IP address and location, attempted login username and password, connection attempt time and frequency, as well as uploaded or downloaded files. Cowrie is an open-source low to medium interactivity honeypot system specifically designed for collecting and analyzing information about SSH and Telnet attackers. It mimics a real SSH and Telnet server to collect information about the attacker. The information collected by Cowrie includes the remote host IP address and location, login attempt username and password, connection attempt time and frequency, and content of command line input. However, both honeypots use a command-line interface for interaction with users, greatly hindering interaction efficiency between users and the system. Additionally, both honeypots can only collect basic intrusion information, and more detailed information about the intruder cannot be collected, causing great obstacles for network analysis. Therefore, in terms of interactivity, low- to medium-interactivity honeypots are undoubtedly poor. Compared to the low interactivity of low to medium interactivity honeypots, intrusion detection systems and log audit systems have relatively higher interactivity. As an example of a highly representative intrusion detection system, Snort uses a rule-based method to detect network intrusions and security threats. Administrators can write custom rules to detect specific types of malicious traffic, or they can use pre-defined rules provided by Snort or third parties. Snort can run in real-time and alert administrators to suspicious activity, or it can be used for offline analysis of network traffic logs. Compared to low-interactivity honeypots, Snort is more accurate in its judgment of intrusion behavior due to its ability for users to write their own rules and describe and review the characteristics of intrusion behavior. The information collected by Snort is diverse and comprehensive, including network attacks such as denial of service (DoS), buffer overflows, and SQL injection attacks. It can also detect malware and other types of malicious software transmitted over the network, as well as policy violation behavior, such as unauthorized access to restricted network resources [6]. However, Snort requires users to define intrusion behavior in advance in the form of a command line, and the logs of intrusion response are also displayed in the form of a command line, which creates great difficulties for the interaction between the system and the user. Taking Graylog as an example, Graylog is an open-source log management system that provides log collection, storage, search, and analysis functions. It enables centralized log management of multiple data sources and supports real-time processing and analysis of data. Graylog uses Elasticsearch as the storage engine and MongoDB as the metadata storage.