I was going through the wikipedia article on Intrusion Prevention Systems.

It states two of the four types of IPS as follows:

Network-based intrusion prevention system (NIPS): monitors the entire network for suspicious traffic by analyzing protocol activity.

Network behavior analysis (NBA): examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware and policy violations.

How exactly are these two types different from one another? To be more specific, what is the difference between analyzing "protocol activity" and examining "network traffic"?

My current understanding is that a NIPS may dig deeper into packets (e.g. possibly examine multiple OSI layer contents) and check if any of the parameters are invalid/prohibited etc. On the other hand, a NBA may concentrate on parameters such as packets per second, number of connections per host etc. Is this understanding correct?

1 Answer 1


As far as I can tell, your understanding should be correct.

Many NIPS systems, including the open source standard Snort, combines the two. From Snort's webpage:

Combining the benefits of signature, protocol, and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide.

So the distinction is mostly just classification for classifications sake.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .