ForeScout pitches honeypot technology as IPS

While we found 11 vendors that met our criteria for in-line network-based intrusion-protection systems, yet more vendors still wanted to be tested even though their products, though interesting, don't quite fit the bill.

One that caught our attention was ForeScout Technologies' ActiveScout. In our experience with the product - we had it up an running in front of our production network for several months in early 2003 - we found ActiveScout to be a kind of honeypot that can be used to efficiently identify and block traffic from the automatic attack tools that most amateur hackers use.

ActiveScout sits in the network on a monitoring port, typically outside the corporate firewall. ActiveScout has no real services and protects no real systems. Instead, it simulates a variety of applications that could be interesting to attackers. The theory is that anyone who connects to one of these simulated applications is up to no good. At that point, ActiveScout uses its monitoring capabilities to attempt to reset any TCP connections from the attacker and reprogram the corporate firewall to block traffic. ActiveScout can take this a step further by feeding back "poison" information to the attacker, such as a particular NETBIOS name. If connection attempts show up from other sources with this poison information in hand, ActiveScout will block traffic from those sources as well.

The benefit to ForeScout's approach is pretty clear: no false positives. Because you're not looking for a signature or any other protocol anomaly, you don't have to worry about misdetecting potential attacks. It's behavioral: Anyone touching that box must be bad and stopped.

What ForeScout doesn't advertise is the flip side of no false positives: Lots of false negatives. Only someone who actually does reconnaissance using this model will get caught. If the bad guys already know where the Web server is - maybe they looked it up in the DNS - ActiveScout won't do anything about the attack, successful or not.

Nevertheless, the great majority of Internet attacks, what we called "background radiation," use a pattern that is susceptible to the kind of technology ForeScout brings to the table. This is why some of the IPS tools we looked at (from NetScreen and EcoNet.com) include honeypot features as well, although not with ActiveScout's level of sophistication.