I haven't read much about such a technique, but I'm wondering if there's any sort of best practice around the use of "canaries" to detect certain types of intrusion:
- Create a bogus account that should never be logged in -- if someone attempts to access that account, report an intrusion attempt.
- "Seed" the database with email addresses or other info that can be monitored. If you start getting email (or snail mail, phone calls, etc) at the monitored info, ring the bell, you're screwed: someone stole your database. (This was how I found out about the Ameritrade data leak from a few years ago -- before they publicly disclosed the leak.)
Clearly things like monitoring 404s for scans will be very noisy. (One of my very low traffic sees tons of requests for phpMyAdmin and wp-content...) And it's obvious that the second bullet above is too late to be worth much. The first bullet might even be too noisy.
A proper IDS is going to do a more thorough job. Is any of this useful? Are there things I'm missing?