Understanding the intrusion detection and prevention system

An intrusion prevention system (IPS) is a security/threat prevention technology that examines network traffic flows to detect and prevent vulnerability exploits. Vulnerability exploits often come in the form of malicious entries in a targeted application or service that attackers use to stop and gain control over an application or machine. After a successful exploit, the attacker can disable the target application (resulting in a denial of service state) or can access all available rights and authorizations for the compromised application.

Prevention
IPS is often located directly behind the firewall and provides a complementary layer of analysis that negatively selects dangerous content. Unlike its predecessor, the Intrusion Detection System (IDS) - which is a passive system that examines traffic and reports on threats - the IPS is placed online (on the direct communication path between source and destination), actively analyzing and performing actions automatically in relation to all traffic flow that enters the network. Specifically, these actions include:

Send an alarm to the administrator (as it could be in an IDS)
Takedown malicious packages
Block traffic from the source address
Reset the connection

As an online security component, IPS must work efficiently to avoid degrading network performance. It should also work fast because exploits can occur almost in real-time. The IPS must also detect and respond accurately, in order to eliminate threats and false positives.