Can IDS detect DDoS attacks? if yes, what's the working methodology?