how does intrusion prevention work