Re: RES: Protocol Anomaly Detection IDS - Honeypots

From: Marc Benoit <marc(at)corsanet.com>
Date: Fri Feb 21 2003 - 18:30:59 EST

('binary' encoding is not supported, stored as-is)
In-Reply-To: <20030221131510.29145.qmail@mail.securityfocus.com>

This basic theory is laid out very well in Activescout by Forescout which is a technology that we rely on internally. A potential intruder performs reconnaissance on your network, the scout picks it up and responds with marked packets representing fictitious honeytokens which you can then act on when they come back with the goods. It works on any network with no falsies and up to much greater speeds than we require.

-Marc

>Lance's point can be expanded in very interesting views. Why use only

---

Does your IDS have Intelligent Attack Profiling? If not, see what you're missing.
Download a free 15-day trial of StillSecure Border Guard. http://www.securityfocus.com/stillsecure Received on Fri Feb 21 18:49:36 2003