intrusion detection and prevention mechanism
A control or capability — realized as software, hardware, or a combination — that monitors system or network activity to identify signs of unauthorized access or policy violation, and takes action to stop or limit detected threats. The phrase joins the well-established "intrusion detection" function (passive monitoring and alerting, as defined in NIST SP 800-94, which characterizes intrusion detection as monitoring events in a computer system or network and analyzing them for signs of possible incidents) with the prevention function (software that automates the monitoring of events in a computer system or network, analyzing them for signs of possible incidents, and attempting to stop detected possible incidents, per the NIST CSRC Glossary entry for IDPS). The phrase "intrusion detection and prevention mechanism" is compositional — it describes any implementation (tool, process, or control) that performs these two functions — whereas the established term of art in the field is "intrusion detection and prevention system (IDPS)," as codified by NIST SP 800-94, which covers IDPS technologies across four classes: network-based, wireless, network behavior analysis, and host-based.
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A control or capability — realized as software, hardware, or a combination — that monitors system or network activity to identify signs of unauthorized access or policy violation, and takes action to stop or limit detected threats. The phrase joins the well-established "intrusion detection" function (passive monitoring and alerting, as defined in NIST SP 800-94, which characterizes intrusion detection as monitoring events in a computer system or network and analyzing them for signs of possible incidents) with the prevention function (software that automates the monitoring of events in a computer system or network, analyzing them for signs of possible incidents, and attempting to stop detected possible incidents, per the NIST CSRC Glossary entry for IDPS). The phrase "intrusion detection and prevention mechanism" is compositional — it describes any implementation (tool, process, or control) that performs these two functions — whereas the established term of art in the field is "intrusion detection and prevention system (IDPS)," as codified by NIST SP 800-94, which covers IDPS technologies across four classes: network-based, wireless, network behavior analysis, and host-based.DR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- This phrase is compositional rather than a term of art. The field has a well-established coined term — intrusion detection and prevention system (IDPS), "a network monitoring strategy that supports threat detection by passively monitoring traffic and actively blocking suspicious or malicious behavior once it is flagged" — standardized in documents such as NIST SP 800-94 and ISO/IEC 27039. "Intrusion detection involves monitoring system or network activities for signs of security violations, while intrusion prevention extends this capability by actively mitigating detected threats"; due to overlapping functionalities, the combined term IDPS is commonly used. "Intrusion detection and prevention mechanism" is simply a descriptive paraphrase that substitutes the generic word *mechanism* for *system*, and carries no distinct or specialized meaning beyond what "IDPS" already conveys.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.