1. Honeypot definition. Regarding honeypots, there is no complete definition so far. Lance Spitzner, the founder of the "Honeynet Project Group", gave a more authoritative definition of honeypot: a honeypot is a security resource whose value lies in being scanned, attacked and compromised. This definition suggests that honeypots have no real purpose and that all network traffic to and from honeypots may indicate scanning, attacks, and compromises. The core value of honeypots lies in monitoring, detecting and analyzing these attack activities. In fact, there are only some false sensitive data in the honeypot, which is not used for normal external services. Therefore, it can be a network, a host, a service, or some useless data in the database or disguised user names and weak passwords, etc., so any interaction with it can be considered Attack behavior, thus simplifying the detection process, it can be deployed on various internal subnets or key hosts to detect various attacks from outside and inside the network system, using one to detect, monitor and capture attack behavior and protect the real host Targeted deception techniques.

2. Basic principles of honeypots. The honeypot system is a trap system that attracts hackers to invade by setting up a system with many loopholes, collects intruder information, and provides more knowledge for other security technologies. Honeypots use two tools, monitors and event logs, to monitor access to the honeypot system. Because honeypots are a very tempting system that can distract hackers' attention and energy, they protect real network resources.

3. Main technologies of honeypots. The honeypot system mainly involves network deception technology, data capture technology, data control technology (turbulence 1:3 redirection), attack analysis and feature extraction and other major technologies. (1) Network deception technology: It is the core technology of honeypots. It uses various deception methods, security weaknesses and system vulnerabilities to lure hackers to attack. (2) Data capture technology: The main purpose is to capture as much attack information as possible without being discovered by hackers, including input, output, keyboard and screen capture. (3) Data control technology: The main purpose is to prevent hackers from using honeypots as a springboard to attack other systems or harm other hosts. Therefore, the data flow in and out of the system must be controlled without being suspected by hackers. (4) Attack analysis and feature extraction: The honeypot system is equipped with a data analysis module to analyze, synthesize and correlate all collected information on the same console to complete the analysis of honeypot attack information.