An intrusion prevention system (IPS) is a security control that inspects network traffic in real time and automatically blocks detected attacks.
How an IPS works
An IPS sits inline – traffic passes through it – and compares packets and sessions with detection rules. An IDS (intrusion detection system) does the same analysis on a copy of the traffic and only raises alerts; an IPS can also drop packets, reset connections or block the source. Detection methods include:
- signatures of known exploits and malware traffic;
- protocol analysis that spots malformed or abnormal requests;
- anomaly detection based on a baseline of normal behaviour.
Today IPS functions are usually built into next-generation firewalls (NGFW); well-known open-source engines are Snort and Suricata. A host-based IPS (HIPS) protects a single server or endpoint.
Why an IPS matters for security
An IPS can stop exploitation of a known vulnerability before a patch is installed (“virtual patching”) and block command-and-control traffic from infected machines. Its limits are important too: encrypted traffic must be decrypted to be inspected, attackers use evasion techniques, and false positives can block legitimate business traffic. The IPS devices themselves have become targets – vulnerabilities in firewalls and security gateways are among the most exploited in recent years.
Best practices
- Keep signatures and the device firmware updated.
- Start new rules in detection mode, tune them, then switch to blocking.
- Combine IPS with endpoint protection (EDR) and log analysis; one control is never enough.
- Restrict management interfaces of security appliances to internal networks.
