IPS Signature Characteristics April 16, 2008 Signature: scans packets looking for a match to known patterns- DB needs update Anomly: tends to report more false positive alarms- can detect zeroday exploits