Intrusion Prevention (IPS) detects and blocks attacks primarily by analyzing traffic patterns and payload characteristics against known signatures, protocol anomalies, and behavioral rules. Many common application-layer exploits have recognizable request structures that IPS engines can match.

An injection attack (such as SQL injection or command injection) typically contains suspicious characters, keywords, and abnormal parameter patterns within application requests. IPS signatures can detect these malicious payload characteristics and either block the session or generate alarms. Directory traversal attacks also have distinct patterns, such as attempts to access unauthorized paths using sequences like ../ (or encoded variants). These are classic web-attack signatures commonly covered by IPS rule sets. Buffer overflow attacks often exploit protocol or application parsing weaknesses by sending overly long fields, malformed headers, or abnormal protocol sequences; IPS can detect these through signature matching and protocol anomaly detection.

A Trojan horse , however, is malware residing on an endpoint (often delivered via files, email attachments, downloads, or user execution). While some network security features (like antivirus/URL filtering/sandboxing) may detect Trojan delivery or command-and-control traffic, “Trojan horse” itself is not typically classified as an IPS-detected attack type in this context. Therefore, A, B, and D are correct.