1. A method of observing mobile device behaviors to recognize mobile device behaviors that are not benign, the method comprising: monitoring in a processor of a mobile device an activity of a software application or process; determining an operating system execution state of the software application or process; and determining whether the activity is not benign based on the activity and the operating system execution state of the software application or process during which the activity was monitored.