1. A method of detecting anomalies in the data traffic of a mobile device, comprising the steps of: collecting at a server and from the mobile device, data traffic statistics for a given time period; comparing the data traffic statistics against threshold values; if a statistic of the data traffic statistic exceeds a corresponding threshold of the threshold values, flagging an anomaly; updating the threshold values based on a running average of each statistic of the data traffic statistics based on formula I, T 0 = T 0 + Max [ T 0 × Δ max 100 , T 0 - ( ∑ i = 1 N ⁢ T i - Max ⁡ ( T 1 , … ⁢ , T N ) ) N - 1 ] wherein T 0 is a current threshold value; Δ max is the maximum change of the threshold value, expressed as a percentage; T i is the value of a corresponding data traffic statistic i time periods prior to the current period; and N is the number of time periods used to compute the updated threshold.