Though IPS devices are the most resource intensive, they
are still relatively high-performing due to the latest processors,
software, and hardware advancements. IPS may be
distributed and hardware based [7-10]. Today two categories
of IPS exist: Network-based Intrusion Prevention and
Host-based Intrusion Prevention. Network IPS monitors
from a network segment level, and can detect and prevent
both internal and external attacks. Network IPS devices
separate networks in much the same fashion as firewalls.
Host IPS software runs directly on workstations and servers
detects and prevents threats aimed at the local host. In both
cases, attack recognition is usually accomplished via two
primary methods of IDS: known-attack detection, and anomalous
behavior detection.