In this work, we have dealt with Intrusion Detection, ID, to secure a medical application deployed on pervasive devices. ID Systems, IDSs, are used to monitor a resource and notify someone in the event of a specific occurrence for an appropriate response. Based on attack identification, they can be those which implement misuse detection, matching against known attack patterns, and those which implement anomaly detection, deviation from normal patterns. Misuse detection is used for matching only known patterns of attacks while anomaly detection is capable of identifying new attacks by matching with an already established normal profile. Based on source of information for the IDS, it may be host-based, network-based or application-based. For our case, we deal with application based anomaly detection modeling issues through building normal users' application usage profiles.