New security threats emerge against mobile devices as the devices? computing power and storage capabilities evolve. We address in this paper the issue of augmenting current intrusion detection approaches with host-based intrusion detection models for mobile devices. We show that host-based approaches are required, since network-based monitoring alone is not sufficient to encounter the future threats. We outline some of the data types on mobile devices that could be used to construct intrusion detection models, and finally propose a framework for mobile device intrusion detection.