which component of an ids examines the collected network traffic and compares it to known patterns of suspicious or malicious activity stored in the signature database?