Sandbox technology is an isolation measure, which is a real host or operating system. Any program that has not been strictly checked for safety is usually run in the system, which not only ensures the safety of other hosts, but also provides convenience for researchers. Honeypot also adopts a similar isolation technology, by disguising itself as a high-value target with high-risk vulnerabilities, luring attackers to attack, and then identifying attackers and collecting attack behavior.