What is an Intrusion Prevention System (IPS)?

Cybersecurity is at the forefront of every conversation for web professionals, agencies, and the companies that host them. User data proves valuable, and attackers are doing everything possible to access it for their gain. As a result, it is increasingly advantageous to detect vulnerabilities and threats and deal with them proactively by implementing an intrusion prevention system (IPS).

What is an Intrusion Prevention System?

An intrusion prevention system is an essential network security technology used to detect and prevent potential threats in real-time. Security vulnerabilities usually come from malicious inputs attackers use to target and interrupt systems to gain control. After a successful exploit, they can impair the target systems or access all the rights and permissions available to the compromised environment.

The intrusion prevention systems monitor network traffic for malicious activities, such as distributed denial of service (DDoS) attacks, viruses, and other vulnerability exploits used to hack systems or applications. A correctly implemented IPS would limit or prevent attackers from gaining elevated access and bringing down infrastructure or using it for nefarious purposes.

How Do IPSs Differ from Intrusion Detection Systems (IDSs)?

In discussing the intrusion prevention system, we must briefly discuss its predecessor, the intrusion detection system (IDS). The only similarity between the two systems is that they monitor network traffic. The difference is in how the traffic gets handled.

IDSs typically get deployed behind your hardware firewall, monitoring network data packets for suspicious activity. It examines network traffic against well-known network attacks to identify threats. Notifications get sent to systems administrators to analyze false-positives or legitimate traffic that gets flagged as an attack.

How Do Intrusion Prevention Systems Work?

Intrusion prevention systems also get deployed in-line behind your hardware firewall, monitoring network data packets for suspicious activity. Like the IDS, it examines network traffic against well-known network attacks to identify threats. However, what it does with this data is very different from the IDS.

Depending on what is detected, malicious packets get dropped instead of reaching their destination. The IPS would also remove or replace the content by eliminating infected files or header information and repackaging payloads.

Another way the intrusion prevention system stops malicious activity is to terminate Transmission Control Protocol (TCP) sessions or block the offending IP address to deny system and application access. It would then reconfigure the firewall to ensure protection from similar attacks.

What are the Types of IPS Detection Methods?

There are several types of detection methods used for intrusion prevention systems, but we will cover three:

Signature-Based Detection

Signature-based detection uses a database to compare detected threats against well-known network threats. The database contains the signatures (or patterns) found in the exploit code. The IPS takes the appropriate action when seen threats match the signatures found in the database. As new vulnerabilities and exploits are detected, the database and the IPS get updated.

Statistical Anomaly-Based Detection

Statistical anomaly-based detection uses a set of definitions to compare against observed network traffic. The IPS looks for unexpected patterns in the data packets. Any abnormal behavior results in the intrusion prevention system taking the appropriate action to mitigate the issue.

Policy-Based Detection

Policy-based detection (also called protocol analysis-based or stateful protocol analysis detection) would be classified more as an IDS method of detection but still applies to the IPS. As the name suggests, it calls for system administrators to configure security policies based on their organization and network infrastructure. Then, they are notified immediately of any behavior that violates the policies they have set.

What are the Classifications of Intrusion Prevention Systems?

The four classifications for intrusion prevention systems are network-based, wireless, network behavior analysis, and host-based. Each one may use one or more of the types of detection methods described above to prevent intrusions.

Network-Based Intrusion Prevention System (NIPS)

The network-based intrusion prevention system (NIPS) is a system used to monitor and protect a network's confidentiality, integrity, and availability. The NIPS analyzes protocol activity and protects against DDoS) attacks and unauthorized usage. It creates physical security zones making the network intelligent, quickly detecting good traffic from bad traffic. 

Wireless Intrusion Prevention System (WIPS)

A wireless intrusion prevention system (WIPS) monitors the radio spectrum for unauthorized access points or wireless attack tools. The system compares the wireless devices’ media access control (MAC) address on the wireless local area network (WLAN).

Because rogue devices can spoof the MAC address of an authorized network device, a technique known as fingerprinting helps weed out copied devices. It compares the unique signatures exhibited by each wireless device against the known signatures of pre-authorized, known wireless devices.

Network Behavior Analysis (NBA)

Network behavior analysis (NBA) collects and analyzes internal network data to identify unusual activity. The behavioral monitoring tools analyze information from various sources, from databases to machine learning, to identify patterns suggesting an attack. Over time, it recognizes typical network behavior and identifies deviations.

Host-Based Intrusion Prevention System (HIPS)

A host-based intrusion prevention system (HIPS) monitors the infrastructure on which it gets installed. It analyzes traffic on the host, noting malicious behavior. As a result, a HIPS offers extensive visibility into what’s happening on your critical security systems, detecting and responding to anomalies in your environment.

Conclusion

Intrusion prevention systems provide a proactive solution to malicious activities. They are a comprehensive system for detecting and preventing these activities from resulting in data loss to your business. In addition, the correct implementation of an IPS will give organizations the advantage of added security for their infrastructure.

Liquid Web offers Threat Stack Oversight, a fully managed intrusion detection system that works with many hosting solutions like VPS, dedicated, Private VPS Parent, cloud servers, and dedicated VMware Private Cloud, as well as High Availability and High Performance solutions.

Speak with a sales representative today to add Threat Stack Oversight to your qualifying Liquid Web hosting environment.