IPS (Intrusion Prevention System)

What is IPS

IPS (Intrusion Prevention System) is an intrusion prevention system that works as an active protection mechanism built into the network infrastructure. Unlike firewalls, which simply pass or block traffic according to static rules (based on IP addresses and ports), an IPS deeply analyzes the contents of packets and the behavior of flows, making a decision in real time: pass, block or limit the transfer speed.

In simple terms, if a firewall is a barrier that checks the car number (IP address), then an IPS is an inspector who searches the contents of the trunk, checks documents and the driver's behavior to make sure there is nothing dangerous in the car. The IPS actively intervenes in the process, blocking suspicious connections and preventing the spread of threats.

IPS is often combined with IDS (intrusion detection system), but the main difference is that an IPS actively intervenes in the process: it resets connections, blocks attacker IP addresses, blocks malicious packets and notifies the information security monitoring center (SOC). In corporate networks, an IPS is deployed at the network edge (in front of the data center) or inside segments to protect critical servers and databases.

According to Gartner, by 2027 more than 80% of large organizations will use IPS as part of their network security strategy, which is due to the growth of complex attacks at the application level (L7) and the increase in traffic passing through corporate networks.

How an IPS works

An IPS uses several methods to detect and block threats, operating in real time (inline):

1. Signature analysis: Comparing traffic with a database of known attacks (an analogue of antivirus signatures). Effective against known threats for which signatures have already been created, but useless against zero-day attacks. Signature databases are updated regularly (daily or weekly).
2. Anomaly (behavioral) analysis: The system learns from typical traffic (creates a profile of normal behavior) and detects deviations (for example, a sharp increase in the number of SYN packets, uncharacteristic traffic on closed ports, anomalous packet sizes).
3. Protocol analysis: Checking compliance of network protocols with standards (for example, detecting HTTP smuggling, fake DNS responses, violations of the TLS protocol).
4. Reputation analysis: Checking IP addresses and domains against reputation databases (Threat Intelligence) to detect connections with known C&C servers (Command and Control) or botnets.

An IPS works in tandem with SIEM systems, transferring events for correlation and analysis. IPS logs are stored in data storage systems for subsequent incident investigation and forensics. Modern IPSs also use machine learning to detect new attack patterns without the need for signatures.

Main types of IPS

IPS is classified by installation location, mode of operation and level of protection:

• Network IPS (NIPS): Installed at key points in the network (at the edge, between segments, in front of the data center). They analyze all passing traffic at the network and application level. The most common type for corporate networks.
• Host IPS (HIPS): Installed on individual servers or workstations. They analyze activity at the OS level (system calls, process launch, changes in the registry). Often integrated with antivirus software and EDR solutions.
• Wireless IPS (WIPS): Protect Wi-Fi networks from unauthorized access points (Rogue AP) and attacks on 802.11 protocols (for example, deauthentication).
• Network Behavior Analysis (NBA): Analyze network traffic to detect anomalies in behavior.

In Russia, the choice of IPS solutions is often determined by the requirements of 187-FZ and the need to use equipment from the Register of Domestic Software. Domestic IPS solutions (for example, UserGate, Positive Technologies) are certified by FSTEC and can be used in state information systems.

Why an IPS is needed and how it protects

An IPS provides protection from a wide range of threats that cannot be stopped by classic firewalls:

• Network attacks: Blocking port scanning, DoS attacks, packet fragmentation, IP spoofing.
• Malware: Detection and blocking of traffic from botnets, C&C servers, as well as attempts to download malicious files (for example, exploits).
• Exploits and vulnerabilities: Prevention of the use of vulnerabilities in protocols and applications (for example, EternalBlue, Heartbleed, Shellshock). The IPS blocks exploitation attempts before they reach a vulnerable server.
• Attacks at the application level (L7): Blocking SQL injections, XSS, command injection in HTTP traffic.

An IPS also helps in incident investigation, providing detailed logs and information about blocked attacks, which is useful for threat analysis and improving security policies.

IPS in the cybersecurity ecosystem

An IPS is not an isolated solution and is part of a comprehensive information protection system. For maximum effectiveness, the IPS is integrated with other tools:

• Next-generation firewalls (NGFW): IPS is often part of an NGFW, providing application-level protection in addition to traditional filtering.
• SIEM systems: The IPS transfers events and logs to SIEM for centralized correlation with other sources.
• EDR/XDR: An IPS protects at the network level, and EDR at the level of end devices. Together they create layered protection, covering all possible attack vectors.
• SOAR: Integration with SOAR makes it possible to automate the response to IPS events (for example, automatic blocking of an IP address in a firewall).

The implementation of an IPS as part of a comprehensive security system requires professional design. The design service and training courses will help correctly configure the system and integrate it with the existing infrastructure.