Protocol-based intrusion detection system