A method for observing mobile device behaviors over a period of time to identify suspicious mobile device behaviors, the method being executed on a computing device and comprising: dynamically selecting for observation one or more mobile device behaviors from a group including mobile device operations, mobile device events, system resource usage, mobile device state, inter-process communications, driver statistics, hardware component status, hardware counters, software downloads, changes to device or component settings, conditions and events at the radio level, and conditions and events at a sensor level, wherein dynamically selecting for observation one or more mobile device behaviors comprises observing mobile device behaviors over the period of time and identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed, wherein identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed comprises: receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface, API after filtering by an adaptive filter; receiving context information regarding operations of the mobile device; performing spatial correlations of the received behavior inputs and the received context input; and generating a behavior vector, wherein generating a behavior vector comprises generating a vector data structure that includes series of numbers, each of which signifies a feature or a behavior of the mobile device; and adaptively observing the selected mobile device behaviors to identify a suspicious mobile device behavior from the limited set of observations. dynamically selecting for observation one or more mobile device behaviors from a group including mobile device operations, mobile device events, system resource usage, mobile device state, inter-process communications, driver statistics, hardware component status, hardware counters, software downloads, changes to device or component settings, conditions and events at the radio level, and conditions and events at a sensor level, wherein dynamically selecting for observation one or more mobile device behaviors comprises observing mobile device behaviors over the period of time and identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed, wherein identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed comprises: receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface, API after filtering by an adaptive filter; receiving context information regarding operations of the mobile device; performing spatial correlations of the received behavior inputs and the received context input; and receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface, API after filtering by an adaptive filter; receiving context information regarding operations of the mobile device; performing spatial correlations of the received behavior inputs and the received context input; and generating a behavior vector, wherein generating a behavior vector comprises generating a vector data structure that includes series of numbers, each of which signifies a feature or a behavior of the mobile device; and adaptively observing the selected mobile device behaviors to identify a suspicious mobile device behavior from the limited set of observations.