IPS to achieve real-time checks and prevent the invasion of the principle of the large number of IPS with the bandpass filter, to prevent all attacks. When the new tools were found after the attack, IPS will create a new band-pass filter. IPS packet processing engine is specialized custom integrated circuits, deep packet inspection of content. If an attacker to use Layer 2 (MAC) to Layer 7 (application) of the loopholes in the attack, IPS will be able to check the data flow in and stop these attacks. Traditional firewalls can only Layer 3 or Layer 4 inspection, we can not detect application layer content. The packet filtering firewall technology will not check for each byte, and hence can not be found offensive, and the IPS can be done to check one by one byte data packets. IPS run through all the data packets have been classified, classification is based on the data packets in the header information, such as source IP address and purpose of IP addresses, ports, and application domain. For different attacks, IPS require different bandpass filter. Each band-pass filter are equipped with the appropriate filtering rules, in order to ensure accuracy of these rules is very broadly defined. In the transmission content classification, the need to filter the light engine packet of information parameters, and resolves to a meaningful domain context analysis to improve the accuracy of filters. Band-pass filter engine combined with water and large-scale parallel processing hardware, can run thousands of data packet filtering checks. Parallel processing filters to ensure that data packets can be continuous through the system quickly and will not affect the speed. This hardware acceleration technology for IPS is of great significance, because the traditional software solutions must filter serial inspection, it can cause system performance greatly reduced. Each bandpass filter should be responsible for the analysis of comparative data packets. Through the inspection of the data packets can continue to move forward, including malicious content data packets will be discarded, is suspected of data packets in need of further examination.
作者:S-Blog