Tag anomaly detection IDS