How do intrusion detection systems work