I. Explain that a signature-based IDPS (also known as a knowledge-based IDPS or misuse detection) examines data traffic in search of patterns that match known signatures: preconfigured, predetermined attack patterns.
II. Focus on the fact that many signature-based IDS technologies are often widely used due to attacks having clear and distinct signatures.
III. Recognize the downside to this type of detection is that as new attack strategies are identified, the IDS’s database of signatures must be continually updated.