An intrusion protection system (IPS) switch system forwards traffic inserted from a switch to a destination port, simultaneously copying and storing the traffic output to an internal port by a port mirroring method of the switch, detecting maleficence inspection of the stored packet based on a protocol/pattern, providing a blocking control policy (e.g., Access Control List (ACL)) to an output port of the switch based on IP or MAC information of the terminal detected of maleficence to prevent expansion of maleficent packets, and transmitting traffic whose destination is outside to the IPS processor to transmit only normal packets to the outside after detecting/blocking maleficence based on the protocol/pattern, and a processing method thereof.