What is an intrusion pre­ven­tion system?

Adding an intrusion pre­ven­tion system (IPS) to a firewall is a valuable choice. It combines the mon­i­tor­ing and analysis ca­pa­bil­i­ties of an intrusion detection system (IDS), but what sets it apart is its proactive ability to actively counter and deter threats.

What does IPS mean?

For most users, the firewall is a tried and tested method of pro­tect­ing their own system or network against attacks from outside. A suitable intrusion pre­ven­tion system (IPS) is a rec­om­mend­ed addition to this pro­tec­tion mechanism. The system works in two steps. First, it performs the tasks of an intrusion detection system (IDS) and monitors either the host, the network, or both to promptly identify unau­tho­rized ac­tiv­i­ties by creating patterns and comparing them with real-time traffic. The second step comes into play when the intrusion pre­ven­tion system iden­ti­fies a threat, at which point it can initiate ap­pro­pri­ate coun­ter­mea­sures.

The dif­fer­ence between an intrusion detection system and an intrusion pre­ven­tions system is that the intrusion pre­ven­tion system only sends a warning to the ad­min­is­tra­tor. The intrusion pre­ven­tion system, on the other hand, actively in­ter­venes, blocks data packets or in­ter­rupts vul­ner­a­ble con­nec­tions. Firstly, it is important that the intrusion pre­ven­tion system is con­fig­ured ap­pro­pri­ate­ly so that all threats are averted without hindering the workflow. Ad­di­tion­al­ly, close col­lab­o­ra­tion between the IPS and the firewall is crucial for optimal pro­tec­tion. Typically, the intrusion pre­ven­tion system is po­si­tioned directly behind the firewall, using sensors to thor­ough­ly assess system data and network packets.

What types of intrusion pre­ven­tion systems are there?

There are different types of intrusion pre­ven­tion systems, primarily differing in their de­ploy­ment locations.

• Host-based intrusion pre­ven­tion systems: Host-based IPS (HIPS) are installed directly on in­di­vid­ual end devices, where they ex­clu­sive­ly monitor incoming and outgoing data. As a result, their active defense ca­pa­bil­i­ties are confined to the specific device they are installed on. HIPS are fre­quent­ly used in con­junc­tion with broader security methods, with the host-based intrusion pre­ven­tion system serving as a last line of defense.
• Network-based intrusion pre­ven­tion systems: Network-based IPS (NIPS) are strate­gi­cal­ly po­si­tioned at multiple locations within a network to scru­ti­nize a large volume of data packets cir­cu­lat­ing within it. They can be deployed through dedicated devices or within firewalls. This setup allows for com­pre­hen­sive scanning and pro­tec­tion of all systems connected to the network.
• Wireless intrusion pre­ven­tion systems : WIPS (Wireless Intrusion Pre­ven­tion System) are specially designed to work in a WLAN network. In case of unau­tho­rized access, the IPS locates the cor­re­spond­ing device and removes it from the en­vi­ron­ment.
• Be­hav­ioral intrusion pre­ven­tion systems: Network Behavior Analysis (NBA) is rec­om­mend­ed for fighting DDoS attacks. This checks all data traffic and can thus detect and prevent attacks in advance.

How does an intrusion pre­ven­tion system work?

The role of an intrusion pre­ven­tion system en­com­pass­es two main aspects. Firstly, it must detect, pre-filter, analyze, and report potential threats, es­sen­tial­ly akin to an intrusion detection system. Fur­ther­more, the intrusion pre­ven­tion system takes proactive measures in response to a threat, in­sti­gat­ing its own pre­ven­tion measures. In both scenarios, the IPS has a range of methods at its disposal.

IPS analysis methods

• Anomaly Detection: Anomaly detection involves comparing network or end-device behavior to a pre­de­fined standard. Sig­nif­i­cant de­vi­a­tions from this standard prompt the intrusion pre­ven­tion system to take ap­pro­pri­ate coun­ter­mea­sures. However, depending on the con­fig­u­ra­tion, this method can also result in frequent false alarms. For this reason, too, modern systems are in­creas­ing­ly relying on AI to sig­nif­i­cant­ly reduce error rates.
• Misuse Detection: In this method, data packets are scru­ti­nized for known forms of attacks. This type of intrusion pre­ven­tion system demon­strates strong detection rates for es­tab­lished threats, iden­ti­fy­ing them with a high degree of certainty. However, it is less effective against novel, pre­vi­ous­ly uniden­ti­fied attacks.
• Policy-based IPS: The policy-based intrusion pre­ven­tion system is less commonly employed compared to the two methods pre­vi­ous­ly discussed. To implement this approach, unique and specific security policies must be con­fig­ured first. These policies serve as the foun­da­tion for mon­i­tor­ing the cor­re­spond­ing system.

IPS defense mech­a­nisms

The intrusion pre­ven­tion system operates in real-time without impeding the data flow. When a threat is detected through the mon­i­tor­ing methods described earlier, the IPS offers several response options. In less critical sit­u­a­tions, similar to an IDS, it sends a no­ti­fi­ca­tion to the ad­min­is­tra­tor for further action. However, in more severe cases, the intrusion pre­ven­tion system takes au­tonomous action. It can disrupt and reset trans­mis­sion paths, block sources or des­ti­na­tions, or even discard data packets com­plete­ly.

What are the ad­van­tages of an intrusion pre­ven­tion system?

The strategic de­ploy­ment of an intrusion pre­ven­tion system offers numerous benefits for users. Most notably, it enhances overall security by detecting risks that might go unnoticed by other tools. Through pre-filtering, the intrusion pre­ven­tion system also al­le­vi­ates the burden on other security mech­a­nisms, safe­guard­ing the entire in­fra­struc­ture. Con­fig­u­ra­tion options enable precise cus­tomiza­tion of the IPS to meet specific re­quire­ments. With suc­cess­ful con­fig­u­ra­tion, the system operates au­tonomous­ly, thereby providing a sig­nif­i­cant time-saving advantage.

What are the dis­ad­van­tages of an intrusion pre­ven­tion system?

Used correctly, an intrusion pre­ven­tion system enhances network security sub­stan­tial­ly. However, there are also some potential drawbacks as­so­ci­at­ed with this approach. In addition to the pre­vi­ous­ly mentioned lim­i­ta­tions of anomaly and misuse detection, there’s a notable concern regarding hardware re­quire­ments. Intrusion pre­ven­tion systems typically demand sig­nif­i­cant resources, which increase in tandem with the network’s size. Therefore, their real value is realized when their ca­pac­i­ties align with the network’s demands. Moreover, con­fig­u­ra­tion can be chal­leng­ing, par­tic­u­lar­ly for non-experts. Sub­op­ti­mal con­fig­u­ra­tions may lead to network issues.

DenyHosts: The best IPS against brute force

In the war on brute force attacks, DenyHosts is a worth­while option. The intrusion pre­ven­tion system was written in Python and is open source. It monitors SSH login attempts and blocks cor­re­spond­ing addresses if they have too many failed attempts. This is the official GitHub re­spos­i­to­ry of DenyHosts.