# Intrusion Detection vs. Intrusion Prevention

While firewalls enforce policy based on *who* is talking to *who*, Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) look for malicious *behavior* or known bad *signatures* within the traffic.

## Intrusion Detection System (IDS)
An IDS is a **passive** monitoring system. It is the security equivalent of a burglar alarm. 

*   **How it connects:** It is normally connected to a "SPAN port" or "Mirror port" on a network switch. The switch sends a *copy* of all network traffic to the IDS. The original traffic flows uninterrupted to its destination.
*   **Action:** When the IDS detects a threat (e.g., an SQL injection payload inside an HTTP request), it generates an alert and sends it to the SIEM for the SOC team to review.
*   **Pros:** Because it sits out-of-band (analyzing a copy), an IDS can never accidentally block legitimate traffic (no false positive blocks). If the IDS crashes, network traffic continues to flow normally.
*   **Cons:** It cannot stop an attack. It only alerts you that an attack is currently happening or has already succeeded. The attack traffic still reaches the target server.

## Intrusion Prevention System (IPS)
An IPS is an **active** defense system. It is the security equivalent of an armed guard at the door.

*   **How it connects:** It is deployed **in-line** with the traffic. All traffic *must* physically flow through the IPS device before reaching the internal network or servers.
*   **Action:** When the IPS detects a threat, it doesn't just generate an alert; it actively **drops the malicious packets**, resets the TCP connection, and blocks the attacker's IP address in real-time.
*   **Pros:** It actually stops attacks before they reach the vulnerable server.
*   **Cons:** Because it sits in-line, a false positive is disastrous. If the IPS mistakes a legitimate customer uploading a legitimate document for a malware attack, it drops the connection, causing a business outage. Furthermore, if an in-line IPS crashes, all network traffic stops unless it fails "open" (which brings its own security risks).

## Detection Methods
Both IDS and IPS use two primary methods to find evil:

1.  **Signature-Based:** Works exactly like traditional antivirus. It looks for a specific string of bytes (a signature) known to belong to a specific threat, like the "EternalBlue" exploit. It is highly accurate but cannot detect brand new, never-before-seen (Zero-Day) attacks because no signature exists yet.
2.  **Anomaly/Behavior-Based:** Uses machine learning and statistical baselines to learn what "normal" network traffic looks like over several weeks. If suddenly the database server starts downloading 50GB of data at 3 AM (which it has never done before), the system flags it as anomalous. This *can* catch Zero-Day attacks, but suffers from a much higher rate of False Positives because networks are inherently unpredictable.