Intrusion Detection and Prevention

Firewalls enforce access rules, but they cannot detect sophisticated attacks hiding within permitted traffic. Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) fill this gap by analysing traffic patterns and payloads to identify malicious activity.

---

IDS vs IPS

Feature	IDS (Intrusion Detection)	IPS (Intrusion Prevention)
Mode	Passive — monitors a copy of traffic	Inline — sits directly in the traffic path
Action	Alerts only — does not block traffic	Blocks malicious traffic in real time
Risk	May miss attacks if alerts are ignored	May cause false positive disruptions
Latency	No impact on network performance	Slight increase due to inline processing
Deployment	Connected via TAP or SPAN port	Deployed inline between network segments

Deployment Comparison

IDS (Passive):
  Traffic ─────────────▶ Destination
       │
       └──── Copy ────▶ IDS ──▶ Alert

IPS (Inline):
  Traffic ──▶ IPS ──▶ Destination
              │
              ▼
         Block / Allow

---

Detection Methods

1. Signature-Based Detection

Compares network traffic against a database of known attack signatures.