What defines Intrusion Prevention?
Intrusion Prevention is a systematic analysis and prevention of undesirable behavior in network traffic. Practically, Intrusion Prevention is an extension of Intrusion Detection. The main difference lies in the fact that Intrusion Prevention is also able to block active traffic or 'drop' packets. Detection is organized based on the content of the traffic, such as suspicious HTTP, FTP, SQL and other commands. Also, 'density' of traffic may be checked. Three login attempts per minute on one webpage are considered normal traffic, whereas 300 of such attempts within 10 seconds definitely raise suspicion.
IPS outfits
Intrusion Prevention Systems (IPS) are available as separate appliances, or as extensions of, for example, firewalling systems. TippingPoint specifically designs and manufactures appliances for IPS, while Check Point and Palo Alto have integrated various IPS functions within their firewalls.
'Virtual patching'
An IPS may also provide protection against exploitation of vulnerabilities in operating systems ('exploits on vulnerabilities'). TippingPoint calls this 'virtual patching'. A major advantage of virtual patching is that one can do without daily or weekly patching of operating systems.