Intrusion Detection System

Placement in Network infrastructure System Type

Detection Mechnanisms

Intrusion Prevention System

Part of the direct line of communication (inline)
Active (monitor & automatically defend) and/or passive

1. Statistical anomaly-based detection
2. Signature detection:
– Exploit-facing signatures
– Vulnerability-facing signatures

IDS Deployment

Outside direct line of communication (out-of-band)
Passive (monitor & notify)

1. Signature detection:
– Exploit-facing signatures



An Intrusion Detection System (IDS) is a monitoring system that detects suspicious activities and generates alerts when they are detected. Based upon these alerts, a security operations center (SOC) analyst or incident responder can investigate the issue and take the appropriate actions to remediate the threat.


An IDS needs only to detect threats and as such is placed out-of-band on the network infrastructure, meaning that it is not in the true real-time communication path between the sender and receiver of information. Rather, IDS solutions will often take advantage of a TAP or SPAN port to analyze a copy of the inline traffic stream (and thus ensuring that IDS does not impact inline network performance).

Intrusion Prevention System Benefits

  • Fewer security incidents. …
  • Selective logging. …
  • Privacy protection. …
  • Reputation-managed protection. …
  • Multiple threat protection. …
  • Dynamic threat response.


  • What is the difference between IPS and IDS? …
The main difference between them is that IDS is a monitoring system, while IPS is a control system. IDS doesn’t alter the network packets in any way, whereas IPS prevents the packet from delivery based on the contents of the packet, much like how a firewall prevents traffic by IP address.

What are Host-based IPS?

A host-based intrusion prevention system (HIPS) is a system or a program employed to protect critical computer systems containing crucial data against viruses and other Internet malware. Starting from the network layer all the way up to the application layer, HIPS protects from known and unknown malicious attacks

What Are The Functions Of Intrusion Detection?

  • The IPS are mainly concerned with monitoring and performing analysis on both the user and the system’s activity. The Intrusion prevention system also checks for the system’s configurations and tries to identify the vulnerability so that the system could be protected against it. It also keeps the check on data integrity by properly assessing the files and the system.

Name some best IPS.

  • Trend Micro TippingPoint NGIPS. by Trend Micro. …
  • Cisco Secure Firewall. …
  • FireEye Network Security (NX) …
  • McAfee’s Network Security Platform (IPS) …
  • Alert Logic Managed Detection and Response (MDR) …
  • Security Onion. …
  • Hillstone S-Series Intrusion Prevention System

What are the kinds of attacks from which IPS protects the network?

The IPS prevents malicious traffic from making any kind of changes in the network that could be harmful. It protects the system from DDOS