Device trust and intrusion detection for embedded systems.

New to EmbedIDS?

Quick Start GuideRunning in 5 minutesComplete TutorialMetrics, rules and custom algorithmsExamplesReady-to-run C samplesCase StudiesEdge AI and Zephyr RTOS, measured

Now a Zephyr RTOS module

Add intrusion detection to Zephyr firmware with a few Kconfig lines. Threads and interrupts submit samples without blocking; one detector thread checks each one.

• ≤ 120 ms from trigger to alert in every simulated attack scenario
• No heap allocation in the detector or the queue adapter
• 19 / 19 tests passing on native_sim with Zephyr v4.2.0

Integration guide Read the case study

examples/zephyr/edge_ai_security/prj.confexcerpt

CONFIG_EMBEDIDS=y
CONFIG_EMBEDIDS_MAX_METRICS=8
CONFIG_EMBEDIDS_SAMPLE_QUEUE_SIZE=32

k_msgq detector · 100 ms EmbedIDS

{"type":"alert","rule":"request_rate","value":256,"limit":32}

Overview

An open-source intrusion detection library that runs on the device, offline, in memory you allocate.

Linuscent OS Product compliance platform

Linuscent Aura™ Shared workspace · SBOMs · vulnerability evidence

EmbedIDS Device layer · trust checks · intrusion detection

• Linux and Jetson agent
• Zephyr RTOS firmware
• Your C11 firmware

EmbedIDS runs on the product itself. It is the device layer of Linuscent OS, where its field signals complement the evidence in Aura.

Product Features

Open-Source SDK (Apache 2.0 Licensed)

One C11 library. You provide the buffers; it checks every sample against your rules.

• No heap allocation
• Threshold rules
• Custom algorithms
• CMake package
• Zephyr module

examples/tutorial_example.c excerpt

static embedids_metric_datapoint_t cpu_history[50];
// …
cpu_metric.type = EMBEDIDS_METRIC_TYPE_PERCENTAGE;
cpu_metric.history = cpu_history;
cpu_metric.max_history_size = 50;
// …
threshold_algo.type = EMBEDIDS_ALGORITHM_THRESHOLD;
threshold_algo.config.threshold.max_threshold.f32 = 80.0f;
threshold_algo.config.threshold.check_max = true;
// …
embedids_metric_value_t value = {.f32 = cpu};
embedids_add_datapoint(&context, "cpu_usage", value, (uint64_t)time(NULL) * 1000);

if (embedids_analyze_metric(&context, "cpu_usage") == EMBEDIDS_OK) {
    printf("OK  CPU: %.1f%% - Normal\n", cpu);
} else {
    printf("ALERT CPU: %.1f%% - THRESHOLD EXCEEDED!\n", cpu);
}

Key Features

On-Device Intelligence

• Detection runs on the device, with no cloud dependency
• Fixed history buffers that you allocate

Customizable Security

• Your own metrics and thresholds
• Custom detection functions beside the built-in rules

Developer-Friendly Design

• CMake package, FetchContent or Zephyr module
• Examples, a tutorial and automated tests

Why EmbedIDS?

1. Tight memory and power budgetsFixed memory, no heap allocation
2. Unreliable connectivityDetection runs offline, on the device
3. Fleet-scale costsOpen source, with no licence fees
4. Diverse hardwarePortable C11 core, Linux agent and Zephyr module

Edge AI devicesModel tampering flagged in 1 s by a ~9 MB agent, in simulationZephyr RTOSEvery scripted attack flagged within 120 ms, in simulation

Getting Started

Three steps from clone to your first alert. Follow the Quick Start.

1. Add EmbedIDS with CMake, or as a Zephyr module
2. Describe each metric and the rule that guards it
3. Feed samples and act on the alerts

Use Cases

• Industrial IoT sensors
• Edge AI devices
• Smart home devices
• Automotive systems
• Medical IoT devices
• Gateways and edge nodes

Community and Support

Questions, ideas and contributions happen in the open.

Open an issue Browse the source Follow Linuscent

Ready to secure your devices? Get the open-source SDK.

Get the SDK on GitHub Read the Quick Start