Intrusion Detection and Prevention

An intrusion detection and prevention system, or IDPS, monitors events for signs of a security incident. It records what it observes, evaluates the evidence, and reports suspicious activity. An intrusion prevention system can also act on that decision. It might drop a packet, reset a connection, block an address, or change another security control.

The distinction is operational rather than cosmetic. A passive intrusion detection system receives a copy of traffic or host events. A mistake creates an alert that an analyst can dismiss. An inline intrusion prevention system sits in the traffic path. A mistake can interrupt a legitimate service. Prevention therefore requires stronger testing, narrower policies, and a defined failure strategy.

The core path is:

event source → sensor → normalization and state → detection logic → alert or prevention action → analyst

The event source supplies packets, wireless frames, flow records, logs, file changes, process activity, or other host events. A sensor collects and interprets that data. The analysis engine rebuilds useful context, such as a TCP stream or a sequence of login failures. Detection logic evaluates the normalized event. The system then records an alert or asks an enforcement point to act. A management console distributes policy and gives analysts a place to investigate results.

Four places to observe

NIST groups enterprise IDPS technologies into four classes. Each class sees a different part of an attack.

Network-based IDPS inspects packets on wired network segments. It can observe many systems from one sensor, but it cannot see plaintext hidden inside encryption unless traffic is decrypted elsewhere.
Wireless IDPS monitors wireless protocols and radio activity. It can identify unauthorized access points, unusual associations, and attacks specific to wireless networks.
Network behavior analysis examines flows and traffic patterns. It is suited to changes in communication behavior, scans, denial-of-service patterns, and other activity that may not contain a known payload signature.
Host-based IDPS runs on or monitors an individual system. It can inspect logs, files, processes, configuration, and system calls that a network sensor cannot see.

Intrusion Detection and Prevention

Four places to observe

Relevant careers