Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was going through the wikipedia article on Intrusion Prevention Systems.

It states two of the four types of IPS as follows:

Network-based intrusion prevention system (NIPS): monitors the entire network for suspicious traffic by analyzing protocol activity.

Network behavior analysis (NBA): examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware and policy violations.

How exactly are these two types different from one another? To be more specific, what is the difference between analyzing "protocol activity" and examining "network traffic"?

My current understanding is that a NIPS may dig deeper into packets (e.g. possibly examine multiple OSI layer contents) and check if any of the parameters are invalid/prohibited etc. On the other hand, a NBA may concentrate on parameters such as packets per second, number of connections per host etc. Is this understanding correct?

share|improve this question
up vote 2 down vote accepted

As far as I can tell, your understanding should be correct.

Many NIPS systems, including the open source standard Snort, combines the two. From Snort's webpage:

Combining the benefits of signature, protocol, and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide.

So the distinction is mostly just classification for classifications sake.

share|improve this answer

Signature based IPS don't work for today's threats. Go for Network Anomaly and Behavior Detection to catch unknown threat within your network. Just look at the last major incidents in the industry and ask yourself: Would had an IPS stopped that threat? In almost every case the answer will be NO. If I had to choose one out of IPS and NBAD and would always go for NBAD.

share|improve this answer
So why would you choose just one out of the two especially when most products combine both functionality? – Terry Chia Mar 24 '13 at 11:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.