Intrusion prevention system (IPS)

An IPS is an intrusion detection engine given the authority to act, which requires it to sit inline - as a transparent bridge, a routed hop, or a module inside a next-generation firewall - so that every packet passes through it before being forwarded. NIST SP 800-94 groups IDS and IPS together as IDPS and lists the typical prevention actions: dropping the offending packet, terminating the session with TCP resets, blocking the source address for a period, rewriting or normalising malicious content, and instructing a firewall or router to change its rules. In open-source deployments Suricata or Snort run in IPS mode by receiving packets from the kernel through mechanisms such as Linux NFQUEUE or AF_PACKET in inline mode and returning a verdict for each; commercial appliances use dedicated hardware to inspect at line rate.

Being inline changes the engineering constraints. The IPS adds latency and becomes a single point of failure, so designs must decide between fail-open (traffic bypasses inspection if the engine or appliance fails, often via a hardware bypass module) and fail-closed (traffic stops). Throughput figures from vendors usually assume a minimal rule set; enabling full signatures, TLS decryption and file inspection can cut real throughput substantially. Stream reassembly and protocol normalisation must be complete before a verdict, since the IPS, unlike a passive IDS, cannot reconstruct traffic afterwards.

False positives are the operational risk that most distinguishes an IPS from an IDS: an IDS false positive costs analyst time, an IPS false positive is a self-inflicted outage. Deployment therefore usually starts in detect-only mode, measures which signatures fire on legitimate traffic, and enables blocking selectively for high-confidence signatures - typically exploit signatures for specific CVEs - while leaving broad heuristics in alert mode. This targeted use is often called virtual patching: blocking exploitation of a known vulnerability on the wire while the actual patch is tested and rolled out. It is a compensating control, not a fix, and it fails against encrypted traffic the IPS cannot decrypt and against exploit variants that the signature does not match.

Related concepts: a web application firewall (WAF) is an application-layer IPS specialised in HTTP, operating on parsed requests rather than packets; host-based IPS functionality is today largely absorbed into EDR; and the IPS modules in NGFWs have largely replaced standalone appliances in enterprise perimeters, although standalone sensors remain common in data centres and OT environments where inline blocking must be tightly controlled.