key method based detection used by IDS and/or IPS technologies

Which key method is used to detect and prevent attacks by use of IDS and/or IPS technologies?