Explain extensively why you should separate intrusion detection system from Host ?