Where is a host-based intrusion detection system located?