Applied Network Security

IDS versus IPS

The differences between IPS and IDS are the way they handle intrusions or attacks and at what level these attacks are taking place. IDSs monitor all inbound and outbound network activity identifying suspicious traffic that indicate an attack is taking place. It then alerts the administrator of the attack and lets you take the proper action based on the type of attack. IPSs work all the way from the system kernel down to the network data packets. It not only identifies the attack or malicious program but it actively works to stop it. Another difference that is IDSs and IPSs look for known intrusion signatures, but IPSs also look for unknown attacks based on its database of generic attack behaviors. This allows IPSs to take action ...