Signature implementations are context- or content-based. Context-based signatures are triggered by the data contained in packet headers. Content-based signatures are triggered by data contained in packet payloads. Figure gives some examples of CIDS signature implementations.

Signature structures are atomic or composite. Atomic signatures are triggered by single packets. Composite signatures are triggered by a series of multiple packets. Figure gives some examples of CIDS signature structures.