a malicious pattern in the network traffic, it can alert the administrators.

In the anomaly-based detection method, an IDS first creates a model of trustworthy activities. Later, it monitors all activities on the host or the network. If it finds any activity that is not considered to be safe, it alerts the administrators. For example, an HIDS may create a model of trustworthy activities when the HIDS is first installed on an uninfected system. Later, if malware infects the system and tries to change any system file, it can detect the change and alert the system administrator.

What is an IPS?

An IPS or Intrusion Prevention System, on the other hand, can detect possible intrusions on a network or host and prevent the intrusion attempt if it finds any. In the case of an IDS, the administrators need to look at the logs to find out whether there was an intrusion attempt, and then the administrators need to take the required actions to prevent such intrusion attempts. But, in the case of IPS, the IPS will block the intrusion attempt if it can detect it.

There can be different types of IPS. A network-based IPS or NIPS analyzes network activities and detects and prevents malicious network intrusions. A wireless intrusion prevention system or WIPS monitors and protects a wireless network. And, a host-based IPS or HIPS can monitor the activities on a single host and detect and prevent possible intrusions.

How does an IPS detect intrusions?

An IPS can also use signature-based or anomaly-based detection methods. In the case of the signature-based detection method, an IPS can monitor the inbound and outbound network traffic and look for signatures of known attacks. If it finds an intrusion attempt, it can block the intrusion attempt.

In the statistical anomaly-based detection method, an IPS looks for anomalies in statistical behavior. For example, it can look for an anomaly in terms of bandwidth, protocol, port, or device being used and detect as well as prevent an intrusion attempt based on that.

An IPS can also use stateful protocol analysis-based detection methods. In that case, an IPS monitors activities and compares them with a predetermined profile of benign activities. And, if it detects an intrusion attempt, it actively prevents it.

IDS vs. IPS – What is the difference?

As we discussed, an IDS only detects an intrusion attempt and alerts the administrators about the malicious activity. The administrators need to look at the log files, analyze the malicious activities and prevent the intrusion attempt. An IDS does not take any action on its own to prevent the intrusion. Instead, manual intervention is required.

But, in the case of an IPS, an IPS system can detect as well as prevent intrusion attempts. If an IPS detects malicious activity, it can block the attempt more like what a firewall does.

But, nowadays many vendors provide an Intrusion Detection and Prevention System or IDPS. These systems can work in both IDS and IPS modes. In the IDS mode, it can only detect intrusions. And, in the IPS mode, it can detect as well as prevent intrusions.

I hope this helps. However, interested readers who want to know more about how different web application attacks work and how we can prevent them can refer to the book “Web Application Vulnerabilities And Prevention.”