KFSensor 4.5.0 is a Server Utility product from keyfocus.net, get 5 Stars SoftSea Rating, KFSensor is a host based Intrusion Detection System (IDS)that acts as a honeypot to attract and log potential hackers and portscanner-kiddies by simulating vulnerable system services and even Trojans. You can create different scenarios, select which ports the software should act upon and what action to take when access is attempted. KFSensor provides detailed logging, analysis of attack and security alerts. The log view dispays details about each attempted access, as well as the computer name and IP address. You can choose to be alerted by sound, blinking tray icon or email. The software can run as service, allowing you to keep it running in the background at all times.
KFSensor Benefits:
* Signature attack identification
KFSensor's rule base signature engine can identify known attack patterns, which outstandingly helps in analyzing the nature of a event. Rules can be imported from external sources in Snort format giving access to a huge amount of security knowledge.
* Detects Windows networking attacks
KFSensor contains the world's only Windows networking/ NetBIOS / SMB / CIFS emulation honeypot. This unique feature enables it to detect the nature of attacks on file shares and Windows administrative services, currently the most prevalent and damaging on the Internet.
* Firewalls can detect port scans, but not the nature of an attack. NIDS can identify certain attacks but not without the risk of compromising security. Only KFSensor can provide the maximum information on an attack, without risk of compromise.
Extendable architecture
* The already comprehensive emulation and reporting features of KFSensor can be further extended by writing your own scripts and database queries.
No false positives
* Firewalls and network based IDS are often overwhelmed by the amount of network traffic and often generate false alarms by misinterpreting legitimate network traffic. KFSensor's honeypot model has no legitimate uses, so all connections to them are suspect.
Low overheads
* KFSensor lies dormant until attacked, consuming very little processor time or network resources. Sensors can be installed on users?machines without affecting their normal use, eliminating the need for additional hardware.
Full converage
* All TCP, UDP and ICMP traffic is monitored for all ports. Remote Administration
Protect different locations in the corporate network with multiple KFSensor installations and manage the process from one location. KFSensor Enterprise Edition provides remote configuration and real time concatenation of events from a single administrator machine using top of the range encryption and authentication.
* Simplicity
The concepts behind KFSensor are easy to understand. Its configuration and operation is straightforward, requiring minimal training and maintenance.
* Advanced server simulation
KFSensor emulates real servers, such as FTP, SMB, POP3, HTTP, Telnet, SMTP and SOCKS to improve deception and gain more valuable information on a hacker's motives.
* Real time detection
Attacks are detected, analyzed and reported immediately allowing response to an attack while still in progress.
* Detects unknown threats
Unlike other products KFSensor does not rely on signatures of known attacks and can therefore detect new or 0 day threats, such as new worms, viruses and elite hackers. KFSensor is just as impactful at detecting internal threats.
* Security in-depth
KFSensor complements other types of security products, such as firewalls, anti-virus and network based IDS systems, to provide an additional layer of protection.
* Designed for a corporate environment
KFSensor's secure design and its capability to work both inside a LAN and in front of a firewall make it suitable for organizations that demand the highest security requirements.
KFSensor Advanced Features:
* Monitors every port
KFSensor Professional monitors attacks on every TCP and UDP port, as well as detecting ICMP or ping messages. It also monitors all network activity of native Windows server applications. Allowing these to act as part of a honeypot configuration.
* Remote administration
KFSensor Enterprise Edition contains the capability to manage and monitor multiple honeypot installations. Events from different sensors across the network are concatenated in real time allowing an immediate view of attacks as they happen. KFSensor uses 3072 bit RSA public/private key authentication and 256 bit AES encryption to provide the top of the range security for communication between sensors.
* IDS signature engine
KFSensor is the first product to combine the benefits of signature-based IDS with a honeypot system. Its fast signature search engine, has a minimal impact on system performance and can handle thousands of rules. It is easy to update the rulebase with new rules from different sources and to create new rules directly from an event. The license of this networking software is Free Trial Software, the price is $990.00, you can free download and get a free trial before you buy. If you want to get a full or nolimited version of KFSensor, you can buy this networking software.