- Signature-based - Signature-based systems match for a specific byte pattern or content in a packet. Such pattern matching is typically combined with particular IP address, protocol, and/or port combinations to perform very precise matches.

- Policy-based - Policy-based systems use algorithms to examine strings of packets to determine patterns and behavior.

- Anomaly-based - Anomaly-based systems look for behavior that deviates from the "norm". 

- Exploit - An exploit signature typically identifies malicious traffic by matching a traffic pattern. Usually, each exploit has a unique signature.

- Connection - A connection signature is aware of valid connections and protocols. The behavior of accepted connections and protocols is known in advance, and any actions that occur beyond the normal circumstances are considered suspect.

- String - String signatures typically use regular expressions to match patterns. A regular expression can be used to match many conditions, whereas an exploit signature usually matches a single exploit.

- DoS - DoS signatures examine behavior typical of a DoS attack.  A behavior change in a DoS attack would require an update to the DoS signature engine.