An Intrusion Prevention System is a cybersecurity solution deployed as a hardware appliance, virtual appliance, or software running alongside a firewall or router. Its primary purpose is proactively protecting networks and systems from various threats, including malware, intrusions, and cyberattacks.
IPS monitors network traffic in real-time, performs deep packet analysis, and inspects packets for malicious patterns, signatures, or behaviors. When it detects a potential threat, it immediately blocks or quarantines the malicious traffic, preventing it from infiltrating the network. IPS also provides alerting and reporting capabilities, helping security teams respond swiftly to security incidents and fortify network defenses against emerging threats.
As you can see in the image above, in a network setup, the IPS is positioned behind the firewall. This arrangement ensures that traffic isn't unnecessarily inspected for threats only to be blocked by firewall policies later. The firewall handles policy-based filtering first. If traffic is allowed according to these policies, the IPS scans for signs of suspicious or malicious activity.
Note: Many next-generation firewalls (NGFWs), such as Cisco Firepower NGFW, support IPS services. This allows you to have both IPS and firewall features in a single unit, eliminating the need for separate systems.
Types of IPS
IPS systems come in two main types, each with distinct deployment and focus:
- Network-based IPS (NIPS): These monitor network traffic at the network layer, inspecting packets as they traverse the network. NIPS are deployed at key network points to detect and prevent threats in real-time.
- Host-based IPS (HIPS): Installed on individual devices like servers or endpoints, HIPS focuses on protecting a single host. It monitors local system activities, applications, and files to prevent threats that might bypass network-level security measures.
Traffic Inspection Methods
IPS systems utilize multiple traffic inspection methods, enhancing their ability to detect and prevent malware and threats in various situations. This diversity increases the catch rate of malicious traffic, enhances overall security, and provides flexibility and adaptability in countering known and emerging cyberattacks while minimizing false positives. Some of the traffic inspection methods used on IPS systems are:
- Signature-based (rule-based) inspection: Signature-based inspection compares network traffic against a database of known attack patterns, or signatures. It is highly accurate for detecting well-known threats but may miss new or evolving attacks.
- Anomaly-based inspection: Anomaly-based inspection monitors network traffic for deviations from established baselines, identifying unusual behavior. It includes:
-
Statistical anomaly detection: This method uses statistical analysis to detect deviations in traffic patterns, such as unexpected spikes or unusual data flows.
- Protocol verification: Protocol verification ensures network traffic adheres to established protocol standards, detecting deviations indicative of attacks.
-
- Policy-based inspection: Policy-based inspection enforces predefined security policies, allowing or blocking traffic based on rules and criteria. It offers fine-grained control over network traffic and security measures, aligning with specific organizational requirements.
These inspection methods collectively strengthen IPS systems' capabilities to detect and mitigate a wide spectrum of threats, providing flexibility and adaptability in countering known and emerging cyberattacks while minimizing false positives.