1. A method for observing mobile device behaviors over a period of time to recognize mobile device behaviors inconsistent with normal operation patterns, the method comprising: dynamically selecting for observation one or more mobile device behaviors from the group mobile device operations, mobile device events, data network activity, system resource usage, mobile device state, inter-process communications, driver statistics, hardware component status, hardware counters, actions or operations of software applications; software downloads, changes to device or component settings, conditions and events at an application level, conditions and events at the radio level, and conditions and events at a sensor level; and adaptively observing the mobile device behaviors to identify a suspicious mobile device behavior from a limited set of observations.