I don't have a project that covers that specific type of thing so .. here's just some thoughts of how it could be done.
You could just use a Motion sensor (MotionMote?) to sense when there is motion in the house, or in a specific room/location.
If the alarm is armed (assuming you arm it when you leave via keypad), and motion is detected, then an alarm event can be triggered.
Your keypad, or alarm controller, can be anything from a single button with dual purpose (press once, arm, press again, disarm) or a keypad with code capability, or a fingerprint reader etc. It could have a simple LCD like the nokia 5110 to show status or a GUI etc. It would include a RFM69/moteino to talk to your gateway which is assumed to be in a more remote location in the house where it cannot be easily/quickly found and disabled by an intruder.
The gateway GUI could have the ability to arm/disarm for your alarm controller node, via usual gateway GUI buttons. This would be a new custom predefined node to include the desired arm/disarm control button that talks to the alarm controller node, and an event to trigger an alarm. Also perhaps an alarm delay event which means that the motion was tripped and it gives 30sec or whatever for the user to disarm the alarm via the controller or gateway GUI.
When motion is detected the controller notifies the gateway that there is motion. The gateway triggers the disarming delay event, which expires in 30sec, after which the real alarm event is triggered.
When an alarm event is triggered, if event delay has expired and no disarming occurred, it could send a message to the front controller that beeps a sound through a piezo buzzer or siren or perhaps a SMS or call the police etc.
This is the big picture, and the concept, as I see it could be done. The details can be customized in many ways. I hope this makes some sense and I hope others can contribute or add more ideas without making it super complicated.