Glossary · simply explained

IDS/IPS (Intrusion Detection/Prevention System)

IDS detects attacks in network traffic, IPS blocks them inline — classic controls, today mostly part of larger platforms.

An intrusion detection system (IDS) monitors network traffic or systems for attack patterns and reports hits; an intrusion prevention system (IPS) sits inline in the data path and blocks detected attacks directly. Both work with signatures of known attacks, complemented by protocol and anomaly analysis.

Today IDS/IPS rarely appear as standalone products: their functions live in next-generation firewalls, FWaaS platforms and cloud security services — centrally supplied with current signatures.

IDS or IPS — detect or prevent?

The difference lies in position and consequence: an IDS observes passively (at a mirror port, say) and alerts — it cannot prevent anything, but cannot break anything either. An IPS stands in the data path and stops attacks in real time — in return, every false positive becomes an operational problem because legitimate traffic gets stuck.

In practice you therefore often start in detection mode, measure false alarms, refine rules — and then switch to blocking selectively. Modern platforms allow this per rule and risk class.

Where IDS/IPS act today

As a module in NGFW and FWaaS: signatures and protocol analysis in the central data path.
At the network edge: virtual patching of known exploits before systems are updated.
In the data center: detection of lateral attacks between segments.
As a sensor building block for NDR and SIEM analysis.

Frequently asked questions about IDS/IPS (Intrusion Detection/Prevention System)

What is the difference between IDS and IPS?

The IDS observes and alerts, the IPS stands in the data path and blocks. An IDS cannot prevent anything but also causes no outages through false alarms; an IPS stops attacks in real time but needs maintained rules and tuning.

Are IDS/IPS still current?

The functions yes — as standalone appliances increasingly rare. Signature and protocol inspection live on in NGFW, FWaaS and cloud platforms, complemented by behavioural analytics (NDR) and endpoint telemetry (EDR). The interplay is decisive.

How does an IPS handle false positives?

False positives are the core risk when blocking: they interrupt legitimate traffic. The staged approach works — first detect and measure, then arm rule by rule — plus exception management and regular reviews of blocked hits.

Does an IPS detect unknown attacks?

Only to a limited extent: signatures detect the known, protocol anomalies catch some beyond that. Genuinely new attacks require behavioural analytics and threat intelligence — which is why an IPS today is one layer of several, not the sole defence.

What is a host-based IDS (HIDS)?

A HIDS runs on the system itself and monitors files, processes and logs there — related to what modern EDR agents do. Network-based systems (NIDS/NIPS) observe the traffic between systems instead.