Abstract: A distributed intrusion detection system (IDS) is provided. The IDS includes, but is not limited to: a plurality of IDS sensors distributed in internet of things (IoT) devices; and a server, coupled to the plurality of IDS sensors through a network, where the plurality of IDS sensors is configured to collect event data from the IoT devices, and the server is configured to: receive the collected event data from the plurality of IDS sensors; determine if an intrusion event occurs by correlating and analyzing the collected event data; and generate an alert in an instance in which the intrusion event occurs.