Intrusion detection systems dedicated to an operating system, and an intrusion detection system in a device implementing at least a first operating system and a second operating system. The intrusion detection systems includes: a listening module (1110) configured to be executed in the first operating system in order to listen to the activity of this first operating system; a collecting module (1120) configured to be executed in the first operating system in order to collect data characterizing the activity of the first operating system; and an analysis and detection module (1150) configured to be executed in the second operating system in order to analyze the data collected in the first operating system and detect a suspicious activity in the first operating system depending on the analysis.