A method of monitoring behaviors of a mobile computing device comprising a master processing core and two or more non-master processing cores , wherein the method comprising: monitoring in the master processing core a distribution of sub-tasks of a software application to at least two non-master processing cores of the mobile computing device, wherein monitoring the distribution of sub-tasks comprises monitoring calls to a transport layer of the mobile computing device; observing in each of said at least two of the non-master processing cores of the mobile computing device activities of the software application, wherein the sub-tasks are performed by different processing cores; generating in each of said at least two of the non-master processing cores a behavior signature that describes in a vector data structure the behavior of the sub-task of the software application observed in the non-master processing core; sending the generated behavior signatures to the master processing core of the mobile computing device; generating an application task graph in the master processing core suitable for use in combining behavior signatures of the at least two non-master processing cores; combining two or more behavior signatures received from non-master processing cores in the master processing core based on the generated application task graph to generate a global behavior vector that identifies the complete behavior of the software application at the mobile computing device from the two or more behavior signatures, wherein the behavior signature enables the master processing core to identify sub-tasks and their positions in the application task graph; providing the global behavior vector to an analyzer module for processing; and processing the global behavior vector by the analyzer module to determine whether the behavior of the software application is consistent with normal operating patterns of the mobile computing device. monitoring in the master processing core a distribution of sub-tasks of a software application to at least two non-master processing cores of the mobile computing device, wherein monitoring the distribution of sub-tasks comprises monitoring calls to a transport layer of the mobile computing device; observing in each of said at least two of the non-master processing cores of the mobile computing device activities of the software application, wherein the sub-tasks are performed by different processing cores; generating in each of said at least two of the non-master processing cores a behavior signature that describes in a vector data structure the behavior of the sub-task of the software application observed in the non-master processing core; sending the generated behavior signatures to the master processing core of the mobile computing device; generating an application task graph in the master processing core suitable for use in combining behavior signatures of the at least two non-master processing cores; combining two or more behavior signatures received from non-master processing cores in the master processing core based on the generated application task graph to generate a global behavior vector that identifies the complete behavior of the software application at the mobile computing device from the two or more behavior signatures, wherein the behavior signature enables the master processing core to identify sub-tasks and their positions in the application task graph; providing the global behavior vector to an analyzer module for processing; and processing the global behavior vector by the analyzer module to determine whether the behavior of the software application is consistent with normal operating patterns of the mobile computing device. <EOS>