What is IDS/IPS?

Intrusion Detection and Prevention (IDS/IPS) pairs two network security functions that inspect traffic for known attack signatures and anomalous behavior. An Intrusion Detection System (IDS) flags a match for review; an Intrusion Prevention System (IPS) acts on it immediately – dropping packets, resetting sessions, or blocking the source before an exploit lands.

Key takeaways

• IDS detects and alerts on threats; IPS detects and blocks them inline.
• Signature-based detection matches known attacks; anomaly detection flags new ones.
• Shared terminology – CVE, CVSS, confidence – scores every signature match.
• Versa VOS applies both through one vulnerability-profile mechanism in NGFW policy.
• A single action setting – alert vs drop/reject/reset – switches IDS mode to IPS mode.

On this page: Why it matters · How it works · Types · IDS/IPS & Versa · FAQ

Why is IDS/IPS important?

A firewall decides which sessions to permit by port, address, and application, but says nothing about what a permitted session carries. Attackers exploit that gap by tunneling exploits and malware inside sessions a firewall would never block. IDS/IPS closes it by inspecting the payload, comparing it against known attack patterns and a baseline of normal behavior, then alerting on a match or stopping it outright.

Pairing detection with prevention matters because each compensates for the other’s blind spot. Detection alone – an IDS watching a mirrored copy of traffic – never risks becoming a point of failure, but cannot stop an attack in progress. Prevention alone – an IPS sitting inline – blocks instantly, but a sensor outage can take the traffic path with it. Running both, tuned by confidence and CVSS severity, lets teams block high-confidence threats automatically while routing uncertain matches to analysts.

What is IDS/IPS?

IDS/IPS is the combined name for intrusion detection and prevention (IDP): a function that inspects network traffic for vulnerabilities and anomalous activity, then reports it (IDS) or blocks it (IPS). Two techniques do the matching. Signature-based detection compares traffic against a database of known attack patterns; anomaly detection baselines normal traffic and flags deviations, catching attacks no signature yet describes.

Every match is scored using shared terminology: a true positive is a real attack correctly flagged, a false positive is benign traffic wrongly flagged, and a false negative slips through undetected. Each finding maps to a CVE (its public identifier) and a CVSS score (its severity), and each signature carries a confidence rating for how reliably it distinguishes attacks from noise.

Types of IDS/IPS

Two axes describe how IDS/IPS is applied. Signature-based detection matches traffic against a database of known-attack patterns – precise against cataloged threats but blind until a signature exists. Anomaly-based detection instead baselines normal traffic and flags statistical deviations, catching zero-day and previously unseen attacks at the cost of more false positives. Most deployments run both together.

The second axis is response mode: detect-only (IDS) mode inspects a mirrored copy of traffic and only alerts, staying out of the forwarding path so a sensor failure never disrupts production traffic; prevention (IPS) mode sits inline and blocks a match immediately – dropping the packet, resetting the session, or rejecting the connection – at the cost of becoming part of the traffic path itself.

IDS/IPS & Versa

Versa VOS delivers IDS/IPS as an intrusion detection and prevention (IDP) capability within its unified threat management services, available on both Secure SD-WAN and NGFW deployments. Rather than separate appliances, Versa implements both through one vulnerability-profile mechanism inside an NGFW access policy rule: the configured action sets the behavior – Alert alone behaves as an IDS, while Drop, Reject, or Reset behaves as IPS enforcement.

Administrators typically start from a predefined profile – the Versa Recommended Profile, covering a decade of CVSS 6–10 vulnerabilities, or the lighter Versa Branch Profile for constrained branches – updated via SPacks, then layer custom Snort-format signatures on top. Director tracks signature compilation; Analytics surfaces threats and IDP logs. See Configure Intrusion Detection and Prevention or Configure Intrusion Detection and Prevention (NGFW).

Frequently asked questions

What does IDS/IPS stand for?

IDS/IPS stands for Intrusion Detection System and Intrusion Prevention System – paired together as intrusion detection and prevention (IDP). The IDS half inspects traffic and alerts on a signature match; the IPS half inspects traffic and blocks a matching threat automatically, without an analyst in the loop.

What is the difference between IDS and IPS?

An IDS monitors a copy of traffic – from a mirror port or network tap – and alerts on suspicious activity without touching the flow. An IPS sits inline and blocks the same activity automatically: dropping packets, resetting connections, or blocking the source.

What is the difference between signature-based and anomaly-based detection?

Signature-based detection matches traffic against a database of known attack patterns, updated regularly through packages such as Versa’s SPacks. Anomaly detection baselines normal traffic and flags deviations from it, letting it catch new attacks – including zero-days – no signature yet describes.

What do CVE, CVSS, and confidence mean in an IDS/IPS alert?

CVE is the public identifier for a known vulnerability; CVSS scores that vulnerability’s severity from 0–10. Confidence rates how reliably a signature distinguishes a real attack from benign traffic – higher values cut false positives at the cost of missing borderline matches.

How does Versa implement IDS/IPS?

Versa VOS applies IDS/IPS as a vulnerability profile within an NGFW access policy rule, running alongside firewalling and application identification in one pass. The configured action – alert versus drop, reject, or reset – determines whether a given rule behaves as detection or prevention.

More on IDS/IPS

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about IDS/IPS, these are worth looking at next.