1. A method of detecting malware in a mobile telecommunications device, the method comprising: maintaining a database of legitimate applications and respective expected behaviours of the legitimate applications; identifying legitimate applications running on the device; monitoring behaviour of the device, the monitored behaviour comprising the sending and receiving of data traffic via a network connection, comparing the monitored behaviour with expected behaviours of the device according to the database for the legitimate applications identified as running on the device; analysing deviations from the expected behaviours of the device to identify potential presence of malware; and in the event that analyzing deviations identifies data traffic is being uploaded to a website when no web browser is running on the device, identifying the upload of the data traffic to the website as indicative of the presence of malware.