Intrusion Prevention System (IPS)

An Intrusion Prevention System (IPS) is a type of network security system that monitors a computer network or protected system for malicious activities or policy violations. IPSs use a variety of security techniques to detect and prevent malicious traffic, such as protocol analysis, anomaly-based detection, and signature-based detection. Typical IPS signature-based detection techniques include virus and worm signatures, blacklisting of known attack patterns, and integrity checks.

IPS is typically deployed in perimeter networks to protect against external attacks, but can also be deployed in local area networks (LANs). In perimeter networks, the IPS inspects all traffic entering and leaving the network. When traffic violations occur, the IPS can prevent the malicious traffic from entering the network and alert the administrator.

In addition to traffic monitoring, IPS can also attempt to permanently disrupt suspicious activity. This is known as Intrusion Prevention Technologies or IPT and consists of practices such as destroying active malicious communications, replying with false information to malicious control signals, and blocking the source IP addresses of suspicious traffic.

IPS can also be used in combination with other technologies such as firewalls to provide additional levels of security. IPS can also work in tandem with other security systems such as antivirus and anti-spam software.

Intrusion Prevention Systems are an effective way to secure networks against malicious activities, but they are not fail proof. IPS can produce false positives, when good traffic is mistakenly identified as malicious. False negatives can also occur, when malicious traffic goes unnoticed. The most effective way to use IPS is when they are coupled with other security devices, and used in tandem with a well-defined security policy.