topic What about the question I in Network Security

Difference between IPS and Anti Malware

mustanserrehman — Sun, 10 Mar 2019 13:40:23 GMT

Can any body help me in understanding deeply about the difference between Anti-Malware and IPS.

Also i was thinking that once a Malware is detected by Anti Malware and it is no longer zero day or Unknown, will the IPS be capable of having the pattern/signature of that malware and block it in future if it comes again?

An IPS scans packets whereas

zdesignstudio — Mon, 22 Aug 2016 13:28:05 GMT

An IPS scans packets whereas a malware scanner scans files. With the Cisco IPS, you can configure in either promiscuous or inline modes. In inline mode, the IPS can identify and drop malicious packets before they're unleashed on the network. In promiscuous mode, a copy of each packet is sent to the IPS and malicious packets are identified after they arrive at their destination. This means viruses, malware, etc. can potentially be activated on the network.

A network malware scanner scans for already installed malware. For instance, if a new flavor of malware is sent as an attachment to an email address on your network, the IPS will not pick it up since it doesn't have a signature for it. If the attachment is opened, it's unleashed. If you have periodic scans done with your network malware scanner, this is something it'll pick up.

https://supportforums.cisco.com/discussion/12216461/network-malware-scanner-vs-ips

Please rate useful posts and mark answers as correct if applicable.

What about the question I

mustanserrehman — Mon, 22 Aug 2016 13:30:10 GMT

What about the question I asked ....

"Also i was thinking that once a Malware is detected by Anti Malware and it is no longer zero day or Unknown, will the IPS be capable of having the pattern/signature of that malware and block it in future if it comes again?"

What platform are you using?

zdesignstudio — Mon, 22 Aug 2016 15:46:56 GMT

What platform are you using?