Systems and methods may include monitoring data input to and output from an application on a mobile device. Such systems and methods may include storing meta-data, which describes a behavior of the data input to and output from the application, on the mobile device. Such systems and methods may include determining whether a behavior of the application is anomalous based on the meta-data stored on the mobile device. Such systems and methods may include providing detailed data, which includes the data input to and output from the application, to another device in response to determining that the behavior of the application is anomalous based on the meta-data stored on the mobile device.