The Overview of the Intrusion Prevention System (IPS)
HI Hi, Greetings! 
Happy January 
Today, I would like to share with you an article about the overview of the Intrusion Prevention System (IPS). Let's move to the article and I will explain part by part.
PART 01:
Introduction of IPS:
An Intrusion Prevention System (IPS) is a network security and threat prevention system that analyzes network traffic patterns to detect and prevent vulnerability exploitation. Attackers utilize vulnerability exploits in the form of malicious inputs to a target program or service to interrupt and take control of the application or computer. Following a successful exploit, the attacker can either deactivate the target program (leading to a denial-of-service condition) or get access to all of the compromised application's rights and permissions.
How An IPS Works (IPS' Operation):
By actively reviewing routed network data, an intrusion prevention system detects malicious activities and recognized attack patterns. On a continuous basis, the IPS engine monitors network traffic and compares it to its internal signature database for known attack patterns. If a packet is determined to be malicious, an IPS may drop it and then block all future traffic from the attacker's IP address or port. Legitimate traffic can flow without causing any apparent service outages.
Intrusion prevention systems can also undertake the more complex observation and analysis, such as monitoring abnormal traffic patterns or packets and reacting accordingly. The following are examples of detection mechanisms:
Addresses that match
Matching HTTP strings and substrings
Pattern matching that is generic
Evaluating TCP connections
Detection of packet anomalies
Anomaly detection in traffic
Matching TCP/UDP ports
Typically, an IPS will log information about detected incidents, notify security administrators, and generate reports. An IPS can automatically receive preventative and security updates in order to continuously monitor and block developing Internet threats, which can assist safeguard a network.
Intrusion Countermeasures:
Many IPS can also actively prevent a threat from succeeding if it is recognized. They employ a variety of response strategies, including:
Changing the security environment, such as establishing a firewall to provide additional protection against previously unknown vulnerabilities.
Altering the attack's content, such as by replacing normally dangerous sections of an email, such as bogus links, with notices regarding the deleted content.
Notifying system administrators of probable security breaches via automated alarms.
Dropping malicious packets that have been discovered.
Factory Resetting a connection.
Traffic from the malicious IP address is blocked.
You are welcome to like and leave feedback in the comment area.
Link:
PART 02:
The Overview of the Intrusion Prevention System (IPS) - PART-02
PART 03:
Source:
https://www.varonis.com/blog/ids-vs-ips
https://www.barracuda.com/glossary/intrusion-prevention-system
https://www.forcepoint.com/cyber-edu/intrusion-prevention-system-ips
https://www.okta.com/au/identity-101/intrusion-prevention-system/
M M Zaheer Hussain
Stay Safe!
