intrusion detection and prevention mechanism
163591·updated Sep 1, 2026A control or capability — realized as software, hardware, or a combination — that monitors system or network activity to identify signs of unauthorized access or policy violation, and takes action to stop or limit detected threats. The phrase joins the well-established "intrusion detection" function (passive monitoring and alerting, as defined in NIST SP 800-94, which characterizes intrusion detection as monitoring events in a computer system or network and analyzing them for signs of possible incidents) with the prevention function (software that automates the monitoring of events in a computer system or network, analyzing them for signs of possible incidents, and attempting to stop detected possible incidents, per the NIST CSRC Glossary entry for IDPS). The phrase "intrusion detection and prevention mechanism" is compositional — it describes any implementation (tool, process, or control) that performs these two functions — whereas the established term of art in the field is "intrusion detection and prevention system (IDPS)," as codified by NIST SP 800-94, which covers IDPS technologies across four classes: network-based, wireless, network behavior analysis, and host-based.
Source
intrusion detectionthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
- Intrusion Detection and Prevention System (IDPS) - Rapid7
- Power Network SCADA Quantum Communications: A Comparison of BB84, B92, E91, and SGS04 Quantum Key Distribution Protocols
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
This phrase is compositional rather than a term of art. The field has a well-established coined term — intrusion detection and prevention system (IDPS), "a network monitoring strategy that supports threat detection by passively monitoring traffic and actively blocking suspicious or malicious behavior once it is flagged" — standardized in documents such as NIST SP 800-94 and ISO/IEC 27039. "Intrusion detection involves monitoring system or network activities for signs of security violations, while intrusion prevention extends this capability by actively mitigating detected threats"; due to overlapping functionalities, the combined term IDPS is commonly used. "Intrusion detection and prevention mechanism" is simply a descriptive paraphrase that substitutes the generic word *mechanism* for *system*, and carries no distinct or specialized meaning beyond what "IDPS" already conveys.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- intrusion detection and prevention mechanisms
- possessive
- intrusion detection and prevention mechanism's
- pluralpossessive
- intrusion detection and prevention mechanisms'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A control or capability — realized as software, hardware, or a combination — that monitors system or network activity to identify signs of unauthorized access or policy violation, and takes action to stop or limit detected threats. The phrase joins the well-established "intrusion detection" function (passive monitoring and alerting, as defined in NIST SP 800-94, which characterizes intrusion detection as monitoring events in a computer system or network and analyzing them for signs of possible incidents) with the prevention function (software that automates the monitoring of events in a computer system or network, analyzing them for signs of possible incidents, and attempting to stop detected possible incidents, per the NIST CSRC Glossary entry for IDPS). The phrase "intrusion detection and prevention mechanism" is compositional — it describes any implementation (tool, process, or control) that performs these two functions — whereas the established term of art in the field is "intrusion detection and prevention system (IDPS)," as codified by NIST SP 800-94, which covers IDPS technologies across four classes: network-based, wireless, network behavior analysis, and host-based.DR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- This phrase is compositional rather than a term of art. The field has a well-established coined term — intrusion detection and prevention system (IDPS), "a network monitoring strategy that supports threat detection by passively monitoring traffic and actively blocking suspicious or malicious behavior once it is flagged" — standardized in documents such as NIST SP 800-94 and ISO/IEC 27039. "Intrusion detection involves monitoring system or network activities for signs of security violations, while intrusion prevention extends this capability by actively mitigating detected threats"; due to overlapping functionalities, the combined term IDPS is commonly used. "Intrusion detection and prevention mechanism" is simply a descriptive paraphrase that substitutes the generic word *mechanism* for *system*, and carries no distinct or specialized meaning beyond what "IDPS" already conveys.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.