Intrusion detection systems dedicated to an operating system, and an intrusion detection system in a device implementing at least a first operating system and a second operating system are provided. The intrusion detection systems includes: a listening module configured to be executed in the first operating system in order to listen to the activity of this first operating system; a collecting module configured to be executed in the first operating system in order to collect data characterizing the activity of the first operating system; and an analysis and detection module configured to be executed in the second operating system in order to analyze the data collected in the first operating system and detect a suspicious activity in the first operating system depending on the analysis.