Does Android OS have intrusion detection systems?

 The goal is - just to block connection access except to specific programs - to just allow programs whose connections have known use - plus to list current sockets in use (to troubleshoot) - plus to warn if the use changes (as measured through heuristics). I know that this is possible if you rebuild the Linux source, but are there rootless solutions (such as system-enforced Virtual Private Networks which do this)?