1. A method of checkpointing in a mobile device, comprising: observing a mobile device behavior over a period of time to collect behavior information; using the collected behavior information to generate a behavior vector that includes a plurality of elements that collectively characterize the observed mobile device behavior; applying a behavior model to the generated behavior vector to generate an analysis result; using the generated analysis result to determine whether the observed mobile device behavior is not consistent with normal operation patterns of the mobile device; storing mobile device state information in a memory as a stored checkpoint in response to determining that the observed mobile device behavior is consistent with the normal operation patterns of the mobile device; and uploading the stored checkpoint to a backup storage system in response to determining that the observed mobile device behavior is not consistent with the normal operation patterns.