An intrusion detection system (IDS)1
is software that automates
the intrusion detection process. An intrusion prevention system
(IPS) is software that has all the capabilities of an intrusion
detection system and can also attempt to stop possible incidents.
Intrusion detection is the process of monitoring the events
occurring in a computer system or network and analyzing them
for signs of possible incidents, which are violations or imminent
threats of violation of computer security policies, acceptable use
policies, or standard security practices. Intrusion prevention is
the process of performing intrusion detection and attempting to
stop detected possible incidents. Intrusion detection and
prevention systems (IDPS) are primarily focused on identifying
possible incidents, logging information about them, attempting
to stop them, and reporting them to security administrators.
IDPSs typically record information related to observed events,
notify security administrators of important observed events, and
produce reports. Many IDPSs2
can also respond to a detected
threat by attempting to prevent it from succeeding. They use
several response techniques, which involve the IDPS stopping
the attack itself, changing the security environment (e.g.,
reconfiguring a firewall), or changing the attack’s content. The
types of IDPS technologies are differentiated primarily by the
types of events that they monitor and the ways in which they are
deployed.