# What is an Intrusion Prevention System (IPS)?

> An intrusion prevention system (IPS) analyzes network, host, wireless, or application activity for signs of possible incidents and can attempt to stop what it detects.

- Canonical URL: https://yellowcube.eu/glossary/intrusion-prevention-system/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Depending on its design, prevention may drop packets, reset a connection, rate-limit traffic, block an address or account, quarantine a host, or prevent a local action.

A network IPS is commonly placed inline so traffic passes through its enforcement path, while host-based prevention acts at the protected system. Some deployments use an off-path detector to request enforcement elsewhere. Because blocking changes live communications, policy must define confidence thresholds, exemptions, response duration, failure behavior, and a rapid way to reverse harmful decisions.

### Key points

- **Detection basis:** Use signatures, protocol validation, behavioral or anomaly methods, reputation, and contextual evidence appropriate to the traffic and assets being protected.
- **Enforcement design:** Determine which actions are local or delegated, how long blocks last, whether state is shared, and what happens during overload, sensor failure, maintenance, or lost control-plane connectivity.
- **Safe operation:** Tune and test in the real environment, stage high-impact rules, monitor false positives and bypasses, preserve evidence, and use site-specific safety and change control for operational technology.
- **Important limitation:** An IPS cannot prevent what it cannot observe or recognize. Encryption, unsupported protocols, evasions, alternate paths, and novel behavior can cause misses, while an incorrect block can disrupt legitimate or safety-critical service.

### Related terms

[Intrusion detection system (IDS)](<https://yellowcube.eu/glossary/intrusion-detection-system/>) · [Deep packet inspection (DPI)](<https://yellowcube.eu/glossary/deep-packet-inspection/>) · [Firewall](<https://yellowcube.eu/glossary/firewall/>) · [Next-generation firewall (NGFW)](<https://yellowcube.eu/glossary/next-generation-firewall/>) · [Network traffic](<https://yellowcube.eu/glossary/network-traffic/>)

### Sources

[NIST glossary: Intrusion Prevention System](https://csrc.nist.gov/glossary/term/intrusion_prevention_system) · [NIST SP 800-94: Guide to Intrusion Detection and Prevention Systems](https://csrc.nist.gov/pubs/sp/800/94/final) · [NIST SP 800-82r3: Guide to Operational Technology Security](https://csrc.nist.gov/pubs/sp/800/82/r3/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.