signature based detection

uses two main methods
payload scanning
packet analysis

payload scanning
most popular
virus scanning
host or server based
can also be on proxy servers

packet analysis
NIDS engines
popular
looks for known attack signatures in packets