What is an intrusion pre­ven­tion system?

Adding an intrusion pre­ven­tion system (IPS) to a firewall is a valuable choice. It combines the mon­it­or­ing and analysis cap­ab­il­it­ies of an intrusion detection system (IDS), but what sets it apart is its proactive ability to actively counter and deter threats.

What does IPS mean?

For most users, the firewall is a tried and tested method of pro­tect­ing their own system or network against attacks from outside. A suitable intrusion pre­ven­tion system (IPS) is a re­com­men­ded addition to this pro­tec­tion mechanism. The system works in two steps. First, it performs the tasks of an intrusion detection system (IDS) and monitors either the host, the network, or both to promptly identify un­au­thor­ised activ­it­ies by creating patterns and comparing them with real-time traffic. The second step comes into play when the intrusion pre­ven­tion system iden­ti­fies a threat, at which point it can initiate ap­pro­pri­ate coun­ter­meas­ures.

The dif­fer­ence between an intrusion detection system and an intrusion pre­ven­tions system is that the intrusion pre­ven­tion system only sends a warning to the ad­min­is­trat­or. The intrusion pre­ven­tion system, on the other hand, actively in­ter­venes, blocks data packets or in­ter­rupts vul­ner­able con­nec­tions. Firstly, it is important that the intrusion pre­ven­tion system is con­figured ap­pro­pri­ately so that all threats are averted without hindering the workflow. Ad­di­tion­ally, close col­lab­or­a­tion between the IPS and the firewall is crucial for optimal pro­tec­tion. Typically, the intrusion pre­ven­tion system is po­si­tioned directly behind the firewall, using sensors to thor­oughly assess system data and network packets.

What types of intrusion pre­ven­tion systems are there?

There are different types of intrusion pre­ven­tion systems, primarily differing in their de­ploy­ment locations.

• Host-based intrusion pre­ven­tion systems: Host-based IPS (HIPS) are installed directly on in­di­vidu­al end devices, where they ex­clus­ively monitor incoming and outgoing data. As a result, their active defense cap­ab­il­it­ies are confined to the specific device they are installed on. HIPS are fre­quently used in con­junc­tion with broader security methods, with the host-based intrusion pre­ven­tion system serving as a last line of defense.
• Network-based intrusion pre­ven­tion systems: Network-based IPS (NIPS) are stra­tegic­ally po­si­tioned at multiple locations within a network to scru­tin­ise a large volume of data packets cir­cu­lat­ing within it. They can be deployed through dedicated devices or within firewalls. This setup allows for com­pre­hens­ive scanning and pro­tec­tion of all systems connected to the network.
• Wireless intrusion pre­ven­tion systems : WIPS (Wireless Intrusion Pre­ven­tion System) are specially designed to work in a WLAN network. In case of un­au­thor­ised access, the IPS locates the cor­res­pond­ing device and removes it from the en­vir­on­ment.
• Be­ha­vi­or­al intrusion pre­ven­tion systems: Network Behavior Analysis (NBA) is re­com­men­ded for fighting DDoS attacks. This checks all data traffic and can thus detect and prevent attacks in advance.

How does an intrusion pre­ven­tion system work?

The role of an intrusion pre­ven­tion system en­com­passes two main aspects. Firstly, it must detect, pre-filter, analyse, and report potential threats, es­sen­tially akin to an intrusion detection system. Fur­ther­more, the intrusion pre­ven­tion system takes proactive measures in response to a threat, in­stig­at­ing its own pre­ven­tion measures. In both scenarios, the IPS has a range of methods at its disposal.

IPS analysis methods

• Anomaly Detection: Anomaly detection involves comparing network or end-device behaviour to a pre­defined standard. Sig­ni­fic­ant de­vi­ations from this standard prompt the intrusion pre­ven­tion system to take ap­pro­pri­ate coun­ter­meas­ures. However, depending on the con­fig­ur­a­tion, this method can also result in frequent false alarms. For this reason, too, modern systems are in­creas­ingly relying on AI to sig­ni­fic­antly reduce error rates.
• Misuse Detection: In this method, data packets are scru­tin­ised for known forms of attacks. This type of intrusion pre­ven­tion system demon­strates strong detection rates for es­tab­lished threats, identi­fy­ing them with a high degree of certainty. However, it is less effective against novel, pre­vi­ously uniden­ti­fied attacks.
• Policy-based IPS: The policy-based intrusion pre­ven­tion system is less commonly employed compared to the two methods pre­vi­ously discussed. To implement this approach, unique and specific security policies must be con­figured first. These policies serve as the found­a­tion for mon­it­or­ing the cor­res­pond­ing system.

IPS defense mech­an­isms

The intrusion pre­ven­tion system operates in real-time without impeding the data flow. When a threat is detected through the mon­it­or­ing methods described earlier, the IPS offers several response options. In less critical situ­ations, similar to an IDS, it sends a no­ti­fic­a­tion to the ad­min­is­trat­or for further action. However, in more severe cases, the intrusion pre­ven­tion system takes autonom­ous action. It can disrupt and reset trans­mis­sion paths, block sources or des­tin­a­tions, or even discard data packets com­pletely.

What are the ad­vant­ages of an intrusion pre­ven­tion system?

The strategic de­ploy­ment of an intrusion pre­ven­tion system offers numerous benefits for users. Most notably, it enhances overall security by detecting risks that might go unnoticed by other tools. Through pre-filtering, the intrusion pre­ven­tion system also al­le­vi­ates the burden on other security mech­an­isms, safe­guard­ing the entire in­fra­struc­ture. Con­fig­ur­a­tion options enable precise cus­tom­isa­tion of the IPS to meet specific re­quire­ments. With suc­cess­ful con­fig­ur­a­tion, the system operates autonom­ously, thereby providing a sig­ni­fic­ant time-saving advantage.

What are the dis­ad­vant­ages of an intrusion pre­ven­tion system?

Used correctly, an intrusion pre­ven­tion system enhances network security sub­stan­tially. However, there are also some potential drawbacks as­so­ci­ated with this approach. In addition to the pre­vi­ously mentioned lim­it­a­tions of anomaly and misuse detection, there’s a notable concern regarding hardware re­quire­ments. Intrusion pre­ven­tion systems typically demand sig­ni­fic­ant resources, which increase in tandem with the network’s size. Therefore, their real value is realised when their ca­pa­cit­ies align with the network’s demands. Moreover, con­fig­ur­a­tion can be chal­len­ging, par­tic­u­larly for non-experts. Sub­op­tim­al con­fig­ur­a­tions may lead to network issues.

DenyHosts: The best IPS against brute force

In the war on brute force attacks, DenyHosts is a worth­while option. The intrusion pre­ven­tion system was written in Python and is open source. It monitors SSH login attempts and blocks cor­res­pond­ing addresses if they have too many failed attempts. This is the official GitHub re­s­pos­it­ory of DenyHosts.