Intrusion Prevention System (IPS)
An Intrusion Prevention System (IPS) is a network security tool that monitors traffic for malicious activity, like an Intrusion Detection System, but can automatically block or reject that traffic in real time to actively prevent an attack.
Definition
An Intrusion Prevention System (IPS) is a network security tool that monitors traffic for malicious activity, like an Intrusion Detection System, but can automatically block or reject that traffic in real time to actively prevent an attack.
Overview
An IPS builds directly on the detection techniques used by an Intrusion Detection System (IDS) — signature matching and anomaly detection — but sits inline in the network path rather than passively observing a copy of the traffic. Because traffic flows directly through the IPS, it can drop malicious packets, reset a suspicious connection, or block an offending IP address the moment a threat is identified, rather than merely generating an alert for a human to act on later. This inline placement is both the IPS's key strength and its central operational risk: a false positive can block legitimate business traffic, causing an outage, so IPS rule sets need careful tuning before enabling automatic blocking in production. Many organizations initially deploy new detection signatures in "alert-only" mode — functioning like an IDS — before promoting confident, well-tested rules to active blocking. IPS functionality is frequently bundled into next-generation firewalls from vendors such as Palo Alto Networks and Fortinet, rather than deployed as a standalone appliance, giving organizations a single device that combines traditional Firewall rules, IPS signatures, and increasingly Web Application Firewall (WAF) capabilities as well. IPS remains a core layer of network defense-in-depth, particularly for blocking known, well-understood attack patterns such as exploit attempts against unpatched vulnerabilities, automated scanning traffic, and known malware command-and-control communication, while more sophisticated or novel attacks typically still require detection and investigation by a human analyst.
Key Features
- Inline deployment that can actively block malicious traffic in real time
- Builds on the same signature and anomaly detection techniques as an IDS
- Can drop packets, reset connections, or block offending IP addresses automatically
- Often bundled into next-generation firewall appliances
- Requires careful tuning to avoid false positives blocking legitimate traffic
- Commonly deployed first in alert-only mode before enabling active blocking