Many small devices are capable of connecting to the Internet now. The trend of pervasive computing and networking is going strong. At the same time, security threats on the Internet continue to increase. Existing defense mechanisms against network-based attacks can hardly apply to small network devices due to limitations of their computing resources. This paper presents a method to mitigate this problem. The approach embeds the attack detection mechanism inside the device’s network module. It focuses on the operational behavior of the module to identify abnormal events. The mechanism does not compete for resources with the main function of the device. It has little impact on the system performance. Furthermore, the method may detect unknown attacks.