There are two types of IDSs available, and several ways to organize them. Some systems are host-based, monitoring system event logs for evidence of misuse. Other systems are network-based, sniffing the network segments that are already watching for misuse. What both systems have in common is that they can only detect the types of attacks that appear in the products' databases of attack signatures. New varieties, as well as minor variations to already recorded attacks, will not be detected or reported.
Most attacks are variations on past attacks.
More recent attacks, based on buffer overflows of FTP servers used in many different Linux systems, did not come in a single form, but rather in more than five variations. The last directory name created contains the actual exploit code. The only thing these attacks had in common was the use of long directory names. Flurries of attacks, all with slightly different signatures, are part of the problem for IDS vendors. No vendor puts out new attack databases every day, or even every week, yet new attacks appear within hours of an original exploit.