I have gone through what IDS/IPS's are. I understand the difference between a NIDS/NIPS and a HIDS/HIPS.
But Host IDS and Host IPS sound like an antivirus software to me, is there a difference?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
First, you talk about HIDS and HIPS.
Since an anti-virus main use is to actively block the access to files detected as malicious, then it would be nearer to an HIPS than and HIDS.
Are they the same thing? This is a good question, especially since Wikipedia states that "The lines become very blurred here, as many of the tools overlap in functionality."
Historically speaking: no. An anti-virus primary goal is to detect and block access to malicious files, while and HIPS solution has a broader goal: it may track changes on the file system (to detect changes not necessarily implying any malicious code, like an unexpected settings change for instance), analyze log filess (system and application logs), check the system components to detect any irregularities, and indeed also try to detect potential malware.
An HIPS solution may be either composed of several different software and the anti-virus be only of them, or one may go toward all-in-one solutions where a single tool will bundle all these functions.
The fact is that nowadays end-user's anti-virus are a bit more than simple anti-virus, over time they have accumulated a very large panel of features turning them more into security suites which can be indeed perceived as end-user's HIPS solutions.
So, my answer here is two folds:
HIDS/HIPS can monitor network packets coming to or from that specific host, and detect almost any modification a local or remote malicious user would make in order to circumvent your security policy, such as tampering with system files or event logs, setting up backdoors, etc.
Antiviruses scan files, emails, and whatever else for signatures known to be associated with malware.