As I understand it, an intrusion protection system (IPS) detects anomalous behavior, does detection of protocol anomalies, and does signature filtering that blocks malware, DDoS, etc. An antivirus also scans the traffic and blocks malware.
I am confused then - what is the difference?
Is an IPS like Checkpoint ultimately adding antivirus signature in IPS only, or is it using entirely new software?
Can Suricata acts as IPS as well as antivirus if i add CLAMAV signatures in it?
A good simplistic way to think of this is that an IPS generally is associated with a firewall, whereas AV is associated with software.
In the McAfee environment I administer, I use IPS to block/allow firewall traffic. So I take what is known and expected, and then block the rest. IPS also looks at what applications are communicating over which ports and to where.
Antivirus, on the other hand, looks at software that wants to run on your device and compares that against a list of known bad executables and, along with heuristics, against a list of known bad behaviors. So AV would stop CryptoLocker by blocking the encryption behavior, and IPS would (theoretically) block it by blocking traffic to its C&C server.
I'm not familiar with Checkpoint so I'm going to defer answers to that question to other folks here.
Both don't exist anymore because it's not 1999. It's 2019.
What you are looking for are Endpoint Detection and Response platforms and/or User Behavior Analytics platforms. Either can work on a combination of endpoint and network data -- but also provide asset as well as indicator search capabilities.
The old tools are having a difficult time adapting to this new paradigm. There are often not direct correlations. You can't say that Suricata is a UBA or that ClamAV is an EDR. They are not, and likely never will be.
Regardless of the brand they have, I prefer to look in host-basedxx or network-basedxx, the job they do in OSI/TCP levels. You may have a laptop and a firewall activated and/or AV product running on your laptop. All of them are running on your laptop. However firewall product is some server running in front of you. Think as another layer before your laptop. This firewall does what it is supposed to do on network.
Vendors, the one mentioned as well, adding malware, avs, url filtering etc to their products. Firewall is like an AV. For instance checkpoint security gateway has firewall, av etc blades like other counterparts. Some vendors separate these features. Some are planning to put everything in it, under the name of like next-generation firewall or UTM. Sometimes I find datasheets of those products confusing as well.
