How does intrusion detection and prevention work?