Intrusion Prevention System (IPS)
What Is an Intrusion Prevention System?
An Intrusion Prevention System (IPS) is a network security technology that monitors traffic in real time, detects threats using signature-based and behavioural analysis, and automatically takes action to block, reject, or redirect malicious traffic before it reaches its target. Unlike an Intrusion Detection System, which only alerts on suspicious activity, an IPS operates inline in the network path and can intervene immediately when a threat is confirmed.
The IPS sits between the network perimeter and the internal environment, inspecting traffic as it flows through and enforcing security policy without requiring human intervention for each detected threat.
How an IPS Responds to Detected Threats
When an IPS identifies a threat matching its detection criteria, it can take several automated response actions:
- Dropping malicious packets before they reach the destination
- Resetting network connections associated with attack traffic
- Blocking the source IP address for a defined period
- Generating an alert for the security team while simultaneously containing the threat
- Triggering downstream actions in integrated security systems such as SIEM or SOAR platforms
Deployment Modes and Positioning
Inline mode: the IPS sits directly in the traffic path and can block traffic in real time. Any IPS failure in this mode can affect network availability, making high availability configuration critical.
Passive (IDS) mode: the same appliance operates in monitoring-only mode, receiving a copy of traffic rather than sitting inline. It cannot block threats but avoids the availability risk of inline deployment.
Next-Generation Firewalls (NGFWs) typically include integrated IPS functionality, providing both perimeter control and intrusion prevention in a single platform rather than requiring a separate dedicated appliance.
Managing False Positives in IPS Deployments
An IPS that blocks too aggressively generates false positives, disrupting legitimate traffic and business operations. Tuning IPS signatures and thresholds to the specific environment, establishing a baseline of normal traffic patterns, and running in detection-only mode before enabling blocking are standard practices for responsible IPS deployment.
Key Takeaways
- An IPS monitors and automatically blocks malicious traffic in real time, distinguishing it from the alert-only function of an IDS.
- Response actions include dropping packets, resetting connections, blocking source addresses, and triggering downstream systems.
- Inline deployment enables blocking but introduces availability risk; passive mode provides detection without intervention.
- NGFWs commonly incorporate integrated IPS functionality, reducing the need for separate dedicated appliances.
- Tuning and false positive management are ongoing operational requirements for any IPS deployment.