Intrusion prevention system

Intrusion prevention systems (IPS), also known as intrusion detection and prevention systems (IDPS), are network security appliances that monitor network and/or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, attempt to block/stop it, and report it.^[1]

Intrusion prevention systems are considered extensions of intrusion detection systems because they both monitor network traffic and/or system activities for malicious activity. The main differences are, unlike intrusion detection systems, intrusion prevention systems are placed in-line and are able to actively prevent/block intrusions that are detected.^[2]^[3] More specifically, IPS can take such actions as sending an alarm, dropping the malicious packets, resetting the connection and/or blocking the traffic from the offending IP address.^[4] An IPS can also correct Cyclic Redundancy Check (CRC) errors, unfragment packet streams, prevent TCP sequencing issues, and clean up unwanted transport and network layer options.^[2]^[5]

Classifications 1
Detection methods 2
See also 3
References 4
External links 5

Classifications

Intrusion prevention systems can be classified into four different types:^[1]^[6]

Network-based intrusion prevention system (NIPS): monitors the entire network for suspicious traffic by analyzing protocol activity.
Wireless intrusion prevention systems (WIPS): monitor a wireless network for suspicious traffic by analyzing wireless networking protocols.
Network behavior analysis (NBA): examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware and policy violations.
Host-based intrusion prevention system (HIPS): an installed software package which monitors a single host for suspicious activity by analyzing events occurring within that host.

Detection methods

The majority of intrusion prevention systems utilize one of three detection methods: signature-based, statistical anomaly-based, and stateful protocol analysis.^[3]^[3]^[7]

Signature-Based Detection: Signature based IDS monitors packets in the Network and compares with pre-configured and pre-determined attack patterns known as signatures.
Statistical anomaly-based detection: A statistical anomaly-based IDS determines the normal network activity —like what sort of bandwidth is generally used, what protocols are used, what ports and devices generally connect to each other— and alerts the administrator or user when traffic is detected which is anomalous (not normal).
Stateful Protocol Analysis Detection: This method identifies deviations of protocol states by comparing observed events with “predetermined profiles of generally accepted definitions of benign activity.”^[3]

References

^ ^a ^b "NIST – Guide to Intrusion Detection and Prevention Systems (IDPS)" (PDF). February 2007. Retrieved 2010-06-25.
^ ^a ^b Robert C. Newman (19 February 2009). Computer Security: Protecting Digital Resources. Jones & Bartlett Learning. pp. 273–.
^ ^a ^b ^c ^d Michael E. Whitman; Herbert J. Mattord (2009). Principles of Information Security. Cengage Learning EMEA. pp. 289–.
^ Tim Boyles (2010). CCNA Security Study Guide: Exam 640-553. John Wiley and Sons. pp. 249–.
^ Harold F. Tipton; Micki Krause (2007). Information Security Management Handbook. CRC Press. pp. 1000–.
^ John R. Vacca (2010). Managing Information Security. Syngress. pp. 137–.
^ Engin Kirda; Somesh Jha; Davide Balzarotti (2009). Recent Advances in Intrusion Detection: 12th International Symposium, RAID 2009, Saint-Malo, France, September 23–25, 2009, Proceedings. Springer. pp. 162–.

External links

Common vulnerabilities and exposures (CVE) by product
NIST SP 800-83, Guide to Malware Incident Prevention and Handling
NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS)
Study by Gartner "Magic Quadrant for Network Intrusion Prevention System Appliances"

Categories

This article was sourced from Creative Commons Attribution-ShareAlike License; additional terms may apply. World Heritage Encyclopedia content is assembled from numerous content providers, Open Access Publishing, and in compliance with The Fair Access to Science and Technology Research Act (FASTR), Wikimedia Foundation, Inc., Public Library of Science, The Encyclopedia of Life, Open Book Publishers (OBP), PubMed, U.S. National Library of Medicine, National Center for Biotechnology Information, U.S. National Library of Medicine, National Institutes of Health (NIH), U.S. Department of Health & Human Services, and USA.gov, which sources content from all federal, state, local, tribal, and territorial government publication portals (.gov, .mil, .edu). Funding for USA.gov and content contributors is made possible from the U.S. Congress, E-Government Act of 2002.

Crowd sourced content that is contributed to World Heritage Encyclopedia is peer reviewed and edited by our editorial staff to ensure quality scholarly research articles.

By using this site, you agree to the Terms of Use and Privacy Policy. World Heritage Encyclopedia™ is a registered trademark of the World Public Library Association, a non-profit organization.

Intrusion prevention system