Many IPS Vendors Rely Heavily on Signatures to Identify and Block Exploits; Why is this not the Best Method?
Signatures, or pattern matching is one of a number of methods that are used in an IPS to detect and block exploits of vulnerabilities. However, if used as the primary protection mechanism, you will face limitations in what will be successfully blocked. Signatures are notorious for generating false positives, which means that on their own, legitimate traffic will be blocked. In addition, attackers have found ways around pattern matching methods by making relatively small changes to the attack code that renders the detection useless; and therefore, not successfully blocked by the IPS. Another trick has a packet reorder engine and is fully stateful, the attack will never be recognized and will simply pass through to the ultimate target. It is therefore important to have multiple protection mechanisms all working simultaneously.
