An Intrusion-prevention system (a computer security term) is used to actively drop packets of data or disconnect connections that contain unauthorised data. Intrusion-prevention technology is also commonly an extension of intrusion detection technology (IDS).
There is as of the time of this writing (2003) no clear definition as to what encompasses an intrusion-prevention system, but in reality it can contain the following functionality:
- To identify unauthorised traffic based on signature matches
- To identify unauthorised traffic based on protocol anomaly detection
- To terminate or degrade the quality of service based on bad matches
- To log and/or alert administration in real-time or historically on matched traffic
- To provide forensic data on its detection of anomalous packets.