At least 10 people were killed in the attack on Monday, which took place a day after a wave of bombings on three churches killed at least 13 people.
ISIL, via its Amaq website, claimed responsibility for the spate of attacks over the past 24 hours.
Tito Karnavian, Indonesia’s police chief, said the suicide attack outside Surabaya’s police headquarters in the city centre was carried out by a family of five, including an eight-year-old girl who survived the attack.
CCTV footage showed two motorcycles approaching the gate of the police station before the explosion took place.
“There were five people on two motorbikes. One of them was a little kid,” Karnavian said. “This is one family.”
The attack killed the four perpetrators and wounded four officers and six civilians.
Joko Widodo, Indonesia’s president, condemned the latest bombing, calling it “cowardly, undignified and inhumane”.
“There will be no compromise in taking action on the ground to stop terrorism,” he told reporters in Jakarta, Indonesia’s capital, on Monday.
Police said Sunday’s church attacks were also carried out by members of one family.
Karnavian said the father drove a bomb-laden car into the city’s Pentecostal church. The mother and her two daughters, aged 9 and 12, attacked the Christian Church of Diponegoro, the police chief added, while the sons aged 16 and 18 rode a motorcycle onto the grounds of the Santa Maria Church and detonated their explosives there.
Just hours after the church bombings, a further three people in another family were killed and two wounded when another bomb exploded at an apartment complex about 30km from Surabaya.
That blast appeared to have been an accidental detonation that killed a mother and her 17-year-old child who was not identified, the police said.
The woman’s husband was badly injured in the explosion.
Police said they arrived after the blast and shot dead the injured man, Anton Febrianto, as he held a bomb detonator in his hand.
“When we searched the flat we found pipe bombs, similar to pipe bombs we found near the churches,” said Karnavian.
Police suspected Sunday’s attacks on the churches were carried out by a cell of the ISIL-inspired group Jemaah Ansharut Daulah (JAD).
The father of the family involved in those attacks was the head of a JAD cell in the city, the police chief said.
Al Jazeera’s Step Vaessen, reporting from Surabaya, said the wave of bomb attacks had put the whole country on “high alert”.
“There are a lot of hoaxes going on social media about possible bomb attacks in other cities as well,” she said.
Indonesia has seen a resurgence in violence in recent years after hundreds of people left for Syria and Iraq to join ISIL, also known as ISIS.
The police initially said the family behind the church attacks was among those who had returned from Syria, but Karnavian said that was incorrect.
The police chief said the attacks in Surabaya may be linked to the imprisonment of JAD’s leader, Aman Abdurrahman, and clashes at a high security prison in Jakarta, in which five counter-terrorism officers and one inmate were killed.
The prisoners were suspected to be supporters of ISIL.
Wiranto, Indonesia’s chief security minister, vowed to step up security across the country.
“The president has commanded that police, helped by TNI (the armed forces), to exert all power to secure the nation,” he told reporters on Monday.
The government will attempt to hasten passage of an updated anti-terrorism law that has languished in parliament, he said.