The Honeynet Quarantine: Reducing Collateral Damage Caused by Early Intrusion Response

Anomaly based intrusion detection is inherently subject to false alarms. Fast and automated intrusion response based on this type of intrusion detection will cause significant usage restrictions for falsely suspected systems. To avoid these negative effects without sacrificing detection sensitivity or increasing the risk for the production network inadequately, we propose a scheme combining anomaly-based IDS with Honeynet concepts and link layer based VLANs. In addition to introducing the concept, we will describe a proof-of-concept implementation and report results from some lab tests confirming the benefits of this approach.