Some systems are host-based, and monitor system event logs watching for evidence of misuse. Network based systems sniff network segments also watching for misuse. What both systems have in common is that they can only detect misuse that appears in the products' databases of attack signatures. New attacks, as well as minor variations on attacks in the signature databases, will not be detected or reported. In this way, most ID systems are like virus scanning software, only as current as the most recent update.
Most attacks are variations on past attacks.
For example, the Teardrop denial of service attack was quickly followed by more than seven different variations, all different enough to foil IDS recognition, yet all potent enough to crash systems. The last directory name created contains the actual exploit code. A networked based IDS would typically look for the pattern contained in the MKD command, the exploit code, and if this changes, the attack will not be detected. Four different attacks were published between February 9 and 11 on Rootshell, including a denial of service attack against IIS 4.0. The only thing these attacks had in common were the use of long directory names.