Signature based IDS/PS An idS/ps consists of a database of rules Each rule specifies a predicate on packet headers, optionally contains a content string, and has an associated action7 Signature based IDS/IPS • An IDS/IPS consists of a database of rules. • Each rule specifies a predicate on packet headers, optionally contains a content string, and has an associated action