It is signature based which means it relies on a massive collection of snippets of text and code that researchers have discovered over the years are associated with unwanted network traffic, be it worms, port scans, or intrusions.
The manual has evolved over time from a relatively small guide for the collection of diagnostic prevalence data to the standard text for every course on psychiatric illness throughout the world.