Abstract: To provide customers with Internet remote services, cloud computing focuses on a large number of computing resources, storage resources and software resources. As cloud computing users, information resources are highly centralized, so the risk of cloud computing security incidents is much higher than the traditional application. Honeypot system can effectively capture the cloud traffic in the attack traffic. However, it is still difficult to develop seductive, protective, and deceptive honeypot systems for cloud computing security development. In this paper, a way was proposed to automatically isolate attack traffic from a real cloud computing server for a honeypot server. The honeypot system was isolated from the real cloud server by creating a virtual machine for a honeypot network server, allowing the honeypot server to have the same memory and storage devices as real cloud computing servers and monitoring the network traffic through OpenFlow. When a visitor visits the server normally, the switch can route the visitor's access request to the real server. When a visitor is marked as a suspicious attacker by IDS, the switch can recalculate the routing path and route the attacker's request to the developed honeypot.