1. A method for detecting anomalies in the data traffic of a mobile device, comprising the steps of: collecting at a server and from the mobile device, data traffic statistics for a given time period; comparing the data traffic statistics against threshold values; if a statistic of the data traffic statistic exceeds a corresponding threshold of the threshold values, flagging an anomaly; updating the threshold values based on a running average of each statistic of the data traffic statistics.