Intrusion-prevention system: Meaning (information, definition, explanation, facts)

An Intrusion-prevention system (a computer security term) is used to actively drop packets of data or disconnect connections that contain unauthorised data. Intrusion-prevention technology is also commonly an extension of intrusion detection technology (IDS).

There is as of the time of this writing (2003) no clear definition as to what encompasses an intrusion-prevention system, but in reality it can contain the following functionality:

• To identify unauthorised traffic based on signature matches
• To identify unauthorised traffic based on protocol anomaly detection
• To terminate or degrade the quality of service based on bad matches
• To log and/or alert administration in real-time or historically on matched traffic
• To provide forensic data on its detection of anomalous packets.

There are other types of intrusion detection and prevention systems now, which detect attacks based on the local activities of programs. One such system is PaX, which both prevents execution of arbitrary code and obfuscates arbitrary execution of existing code.