An intranet is a private network which is heavily protected by different networking devices like router, firewall, IPS and IDS, proxy server and honeynet.
IDS detects the danger
IDS stands for Intrusion Detection System, and is installed near to the network. IDS is a passive system that detects incoming traffic. Once the IDS detects a danger it sends the information to the IPS which takes the action.
IPS quarantines the danger
IPS stands for Intrusion Prevention System and actively detects dangers to prevent intrusion and takes action on them. The IPS’ process include:
INSPECTION & INVESTIGATION
- Inspection: Includes signature-based inspection and anomaly-based inspection
- Investigation: Includes analyzing suspicious packets and activities.
ACTION
Dnagerous or suspicious packets are quarantined or dropped by the IPS
LOGGING AND REPORTING
IPS is able to log and report the data about suspicions.
Both the IPS and the IDS can be combined into one device or even with other devices like routers and firewalls.
Unified Threat Management is an example.