Prior research on active networks has outlined a vision of broad applicability. We present rationale and techniques for applying active network concepts and technology to the automated intrusion response problem domain, and in particular, automated defense against distributed denial-of-service (DDoS) attacks. We describe our experience exploring these ideas via prototyping using the Secure ANTS execution environment in a deployment scenario that requires active programs to migrate across network administration boundaries. From this experience, observations are drawn on the suitability of active networks for this problem domain.