Network Intrusion Detection and Prevention

A Network Intrusion Detection and Prevention System (IDPS) represents the intersection between intrusion detection and intrusion prevention. It monitors and analyzes network traffic for suspicious or abnormal activity. Identifying a potential threat is based on a combination of deep learning and predefined rules.  

Sometimes, this might involve sending an alert to a network administrator. The IDPS might block traffic from the source address or even engage other cybersecurity solutions to mitigate a potential attack. Some IDPS solutions can even neuter attacks by removing malicious software or code.

Like most criminals, threat actors work best when they can operate in the shadows, away from the prying eyes of security teams. Allowing them to do so is not an option. It’s your job to shine a light on your attackers and stop them in their tracks.

Intrusion Detection Systems (IDSs) and Intrusion Prevention Systems (IPSs) together allow you to do precisely that.

As the name suggests, there are two sides to the functionality of an IDP—detection and prevention. Or, to put it another way, how the system identifies and remediates threats. Per the National Institute of Standards and Technology, there are three primary classes of detection methodologies.

1. Signature-based detection is based on matching activity or behavior patterns with known threats. This could include known malware characteristics, abnormal system configurations, or apparent violations of an organization’s security policy. The primary shortcoming of signature-based detection is that it’s not capable of understanding or assessing complex communications or recognizing a previously unknown threat.

2. Anomaly-based detection compares network activity against an established baseline, flagging any deviations as potentially malicious. The only real drawback of anomaly-based detection is that it requires time to train the system and establish a behavioral profile for every entity on a network. An inexperienced user could also inadvertently include malicious activity as part of a profile.

3. Stateful protocol analysis is similar to anomaly-based detection, save that it leverages vendor-developed behavioral profiles which can be applied universally. Although they can be resource-intensive, they often identify attacks that other methods miss. With that said, it’s possible to fool a stateful protocol analysis system by masking malicious activity with acceptable protocol behavior.

Prevention capabilities can be either passive or active and include:

• Ending a TPC session
• Activating an inline firewall
• Throttling bandwidth usage
• Altering or removing malicious content
• Reconfiguring network security devices
• Activating a third-party script or program