Where and when to use host based intrusion detection system ?