1. A computer-implemented method for enhancing security, comprising: under the control of one or more computer systems configured with executable instructions, monitoring connection attempts to a server computer system; detecting, as part of said monitoring, an in-progress port scan of the server computer system by an attacker computer system; and as a result of detecting the in-progress port scan, modifying the server computer system to: accept connection attempts at least from the attacker computer system on both a first set of ports open until detecting the in-progress port scan and a second set of ports closed for an amount of time until detecting the in-progress port scan; provide attack responses to the attacker computer system from at least a first subset of the first set of ports and at least a second subset of the second set of ports, the attack responses from the first subset of the first set of ports configured to be different than responses that would have been provided to the attacker computer system had the in-progress port scan been undetected, the attack responses including at least one response misidentifying a service behind a particular in-use port of the first set of ports and falsely indicating existence of a particular service behind a particular port of the second set of ports; and wherein misidentifying the service is accomplished by providing, to an attacker, a service response on the particular in-use port, the service response corresponds to a different known service than the service on the particular in-use port.