Suggest an editImprove this articleRefine the answer for “What is IPS?”. Your changes go to moderation before they’re published.Approval requiredContentWhat you’re changing🇺🇸EN🇺🇦UAPreviewTitle (EN)Short answer (EN)**IPS (Intrusion Prevention System)** detects attacks and automatically blocks them. **Key point:** if IDS is an "alarm system," IPS is a guard that acts immediately, which is why IPS must be configured carefully so it does not block legitimate traffic.Shown above the full answer for quick recall.Answer (EN)Image**IPS (Intrusion Prevention System)** is an **intrusion prevention system** that **detects attacks and automatically blocks them**. In simple terms: *IPS is an IDS that not only notices an attack but also stops it right away.* --- ## Why IPS is needed IPS is needed to: - **prevent attacks in real time**; - protect services without administrator involvement; - complement a firewall by closing off more "clever" attacks. If IDS is an "alarm system," then **IPS is a guard that acts immediately**. --- ## How IPS works IPS: 1. analyzes network traffic **on the fly**; 2. detects an attack (by signatures or anomalies); 3. **blocks the traffic**, the connection, or the source. Since IPS sits **in the path of the traffic**, it can: - terminate a connection; - block an IP; - drop malicious packets. --- ## Main types of IPS ### 1. NIPS (Network IPS) **A network intrusion prevention system** - analyzes network traffic; - protects many devices at once; - works transparently for users. Often placed behind a firewall. --- ### 2. HIPS (Host IPS) **A host intrusion prevention system** - runs on a specific server or computer; - blocks malicious actions in the system; - controls processes and files. Useful for protecting critical servers. --- ## Attack detection methods ### 1. Signature-based - blocks known attacks by pattern; - fast and accurate. Does not see fundamentally new attacks. --- ### 2. Anomaly-based - analyzes deviations from normal behavior; - can block unknown attacks. False blocks are possible. --- ## The difference between IDS and IPS (briefly) | Criterion | IDS | IPS | |---|---|---| | Attack detection | Yes | Yes | | Automatic blocking | No | Yes | | Sits "in line" with traffic | No | Yes | | Risk of false blocks | None | Present | --- ## Limitations of IPS It is important to remember: - incorrect configuration can block legitimate traffic; - it requires careful testing; - it consumes resources. That is why IPS needs to be **configured carefully**.For the reviewerNote to the moderator (optional)Visible only to the moderator. Helps review go faster.