An intrusion prevention system IPS detection processing method, comprising: determining (101, 203, 303, 304, 305, 403, 404, 405), by a network security device, whether an internal network device is a client or a server, wherein the network security device is deployed between the internal network device and an external network device, and is configured to protect security of the internal network device; if the internal network device is the client, simplifying (102, 204, 304, 406), by the network security device, an IPS signature rule base preset in the network security device to obtain an IPS signature rule base corresponding to the client, or if the internal network device is the server, simplifying (102, 205, 305, 407) the IPS signature rule base preset in the network security device to obtain an IPS signature rule base corresponding to the server; and generating (103, 206, 207, 306, 307, 408, 409), by the network security device, a state machine according to a signature rule in the IPS signature rule base obtained through simplifying processing, and performing IPS detection on traffic flowing through the network security device by applying the state machine; characterized in that the determining whether an internal network device is a client or a server comprises: performing, by the network security device, statistical processing on flowing-through traffic information, and obtaining traffic characteristic information; and determining whether the internal network device is the client or the server according to the traffic characteristic information; wherein simplifying (102, 204, 304, 406) the IPS signature rule base preset in the network security device to obtain the IPS signature rule base corresponding to the client comprises: setting (204, 304, 406) a signature rule corresponding to the server in the IPS signature rule base preset in the network security device to a deactivated state; the simplifying (102, 205, 305, 407) the IPS signature rule base preset in the network security device to obtain the IPS signature rule base corresponding to the server comprises: setting (205, 305, 407) a signature rule corresponding to the client in the IPS signature rule base preset in the network security device to a deactivated state. determining (101, 203, 303, 304, 305, 403, 404, 405), by a network security device, whether an internal network device is a client or a server, wherein the network security device is deployed between the internal network device and an external network device, and is configured to protect security of the internal network device; if the internal network device is the client, simplifying (102, 204, 304, 406), by the network security device, an IPS signature rule base preset in the network security device to obtain an IPS signature rule base corresponding to the client, or if the internal network device is the server, simplifying (102, 205, 305, 407) the IPS signature rule base preset in the network security device to obtain an IPS signature rule base corresponding to the server; and generating (103, 206, 207, 306, 307, 408, 409), by the network security device, a state machine according to a signature rule in the IPS signature rule base obtained through simplifying processing, and performing IPS detection on traffic flowing through the network security device by applying the state machine; performing, by the network security device, statistical processing on flowing-through traffic information, and obtaining traffic characteristic information; and determining whether the internal network device is the client or the server according to the traffic characteristic information; setting (204, 304, 406) a signature rule corresponding to the server in the IPS signature rule base preset in the network security device to a deactivated state; setting (205, 305, 407) a signature rule corresponding to the client in the IPS signature rule base preset in the network security device to a deactivated state.