Network Intrusion Prevention capabilities are part of the
Deep Edge base functionality. An Intrusion Prevention
System (IPS) identifies and stops many threats, exploits, back-door programs, and
other attacks
as they pass through the device. An IPS can bolster a firewalls security policy by
ensuring that
traffic allowed by the firewall rule policy is further inspected to make sure it does
not contain
unwanted threats.
Patterns used to detect threats are released before official updates or patches become
available—protecting businesses during this crucial period. Deep Edge IPS is a
deep-packet-inspection system which peers inside the traffic packets and removes certain
packets
which contain undesired contents that are compared against a deployable rules list
of several
hundred patterns. This signature list of patterns is live-updated every few minutes
and
constantly adapts and evolves to keep administrators protected from threats as soon
as they emerge and
spread.
The IPS provides support for the common attack types such as:
- DoS/DDoS attacks
- Protocol attacks
- OS attacks
- Application attacks
- Malformed traffic/Invalid header attacks
- Malware and blended attacks
- TCP Segmentation and IP Fragmentation attacks
- Port Scans
The IPS solution has pre-defined policy templates for common applications and protocols
to make
the IPS function easy to use. Trend Micro provides pre-defined rules but also allows
administrators to create custom IPS rules.
