Regarding SSL: SSL Termination may happen before the IDS looks at the traffic. Just because a webserver is capable of handling SSL/TLS doesn't mean that it has to be done at the webserver. There might be a machine at your network border which encrypts and decrypts SSL traffic.
Apart from that, an IDS isn't limited to individual network streams. It might record all traffic and build statistics about what is considered normal. Then if traffic flows suddenly change, for example if the distribution of source adresses changes significantly, or traffic volume massively increases, or there is suddenly traffic between machines that never communicated before, or any other pattern you can think of changes, it might alert humans. This can all be done without looking at the traffic payloads; looking at the TCP/IP header and the traffic volume and timing is enough for this kind of analysis.