1. A method of analyzing a behavior of an application operating in a mobile station, comprising: receiving, in a processor of the mobile station, mobile-station-model-agnostic behavior pattern information from a server; using, by the processor, the received mobile-station-model-agnostic behavior pattern information to generate a mobile-station-model-specific behavior model in the mobile station; monitoring, by the processor, one or more mobile station operations to collect behavior information in the mobile station; analyzing, by the processor, the behavior of the application operating on the mobile station by applying the collected behavior information to the generated mobile-station-model-specific behavior model; classifying, by the processor, the behavior of the application operating on the mobile station as not benign based on a result of applying the collected behavior information to the mobile-station-model-specific behavior model; and removing the application associated with the behavior classified as not benign.