there are several types of intrusion detection systems (idss). what type of ids builds a profile of an environment's normal activities and assigns an anomaly score to packets based on the profile?