It is not necessary that the occurrence data be held in the same memory or address space as other components of the signatures; the occurrence data may be held in a list or other structure elsewhere within or external to the intrusion detection system 120. [0030] Although the exemplary signature table 130 of FIG. 2 is shown as a linear structure, which lends itself to a linear search, the present