I wonder whether Network Shield has its threat database

[system]

In other words, it is based on anomaly analysis or signature scan?

Best regards,

[Vlk]

Simple answer: signature scan.