I was going through the wikipedia article on Intrusion Prevention Systems.
It states two of the four types of IPS as follows:
Network-based intrusion prevention system (NIPS): monitors the entire network for suspicious traffic by analyzing protocol activity.
Network behavior analysis (NBA): examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware and policy violations.
How exactly are these two types different from one another? To be more specific, what is the difference between analyzing "protocol activity" and examining "network traffic"?
My current understanding is that a NIPS may dig deeper into packets (e.g. possibly examine multiple OSI layer contents) and check if any of the parameters are invalid/prohibited etc. On the other hand, a NBA may concentrate on parameters such as packets per second, number of connections per host etc. Is this understanding correct?