As I understand it, an intrusion protection system (IPS) detects anomalous behavior, does detection of protocol anomalies, and does signature filtering that blocks malware, DDoS, etc. An antivirus also scans the traffic and blocks malware.
I am confused then - what is the difference?
Is an IPS like Checkpoint ultimately adding antivirus signature in IPS only, or is it using entirely new software?
Can Suricata acts as IPS as well as antivirus if i add CLAMAV signatures in it?