Abstract: The characteristics and problems of Intrusion Prevention System (IPS) architecture were analyzed and a distributed IPS model based on near neighbor distance was proposed in this paper. In the model, message types transmitted between cooperation nodes were defined, and a message-based cooperation method was adopted to enhance the flexibility for system deployment. In order to reduce the redundant message, the distance between nodes was calculated and the communication region was optimized in the model. The experimental results show that the model decreases the IPS net- work load evidently.

Key words: Distributed, Intrusion prevention system(IPS) , Network load, Cooperation