Signature-based IDPS systems use a database of known attack signatures to detect malicious activity. These signatures are typically based on patterns of network traffic that are associated with specific attacks. When the IDPS detects a signature in the network traffic, it alerts the administrator.
Signature-based IDPS systems are effective at detecting known attacks, but they are not as effective at detecting new or unknown attacks. This is because the database of signatures needs to be updated regularly with new attack signatures.