With the increasing frequency,stealth,and complexity of network attacks,traditional passive defense methods struggle to identify new threats in a timely and effective manner.Firstly,the basic principles and implementation mechanisms of Cowrie honeypots are introduced.Next,the system architecture design for active capture in computer room networks is elaborated,specifically discussing the core components of honeypot deployment,data collection,and analysis.Finally,the effectiveness and real-time performance of the system in capturing attack behaviors are validated based on an experimental test environment.