1. A method of determining an execution state of a software application or process in a mobile device, the method comprising: monitoring in a processor of the mobile device an activity of the software application or process to collect behavior information; generating a behavior vector based on the collected behavior information; and determining the execution state of the software application or process by applying a classifier model to the behavior vector.