It is signature based which means it relies on a massive collection of snippets of text and code that researchers have discovered over the years are associated with unwanted network traffic, be it worms, port scans, or intrusions.
It wasn't so secret about a week ago when I discovered his public profile on Instagram, where he was posting dramatic photos and soulful "Versagrams" (graphical text messages), for all the world to see.