1. A method comprising: receiving, by a mobile device, data for an application including a set of application permissions describing elements of the mobile device to which the application will have access upon installation of the application; determining, by the mobile device, a type for the application, wherein the type for the application corresponds to a set of expected elements of the mobile device to which applications of that type have access upon installation; and based on a comparison of the set of application permissions for the application and the set of expected elements of the mobile device to which the type for the application corresponds, determining, by the mobile device, whether the application includes malware.