What is IPS?

IPS (Intrusion Prevention System) is an intrusion prevention system that detects attacks and automatically blocks them.

In simple terms: IPS is an IDS that not only notices an attack but also stops it right away.

---

#Why IPS is needed

IPS is needed to:

• prevent attacks in real time;
• protect services without administrator involvement;
• complement a firewall by closing off more "clever" attacks.

If IDS is an "alarm system," then IPS is a guard that acts immediately.

---

#How IPS works

IPS:

1. analyzes network traffic on the fly;
2. detects an attack (by signatures or anomalies);
3. blocks the traffic, the connection, or the source.

Since IPS sits in the path of the traffic, it can:

• terminate a connection;
• block an IP;
• drop malicious packets.

---

#Main types of IPS

#1. NIPS (Network IPS)

A network intrusion prevention system

• analyzes network traffic;
• protects many devices at once;
• works transparently for users.

Often placed behind a firewall.

---

#2. HIPS (Host IPS)

A host intrusion prevention system

• runs on a specific server or computer;
• blocks malicious actions in the system;
• controls processes and files.

Useful for protecting critical servers.

---

#Attack detection methods

#1. Signature-based

• blocks known attacks by pattern;
• fast and accurate.

Does not see fundamentally new attacks.

---

#2. Anomaly-based

• analyzes deviations from normal behavior;
• can block unknown attacks.

False blocks are possible.

---

#The difference between IDS and IPS (briefly)

---

#Limitations of IPS

It is important to remember:

• incorrect configuration can block legitimate traffic;
• it requires careful testing;
• it consumes resources.

That is why IPS needs to be configured carefully.