TCP connections work on what we call ports. I am not going to take the time to explain what these are and how they work. If you are going to setup an IDS system you should have a good understanding of the way IP connections work. That is a very simple example of pattern matching. They can get much more complicated and can look for much more than just windows trojans.
Lets take a look at something a bit more complicated now.
Take for instance a port-scan. When an IDS system looks for a port scan what it needs to see is a certain number of connections from a remote host to a machine in your network over different ports. How many connections will usually change depending on where you are at. Most vendors let you change the number. There are always a few things you must watch out for.