1. A method of observing mobile device behaviors in a mobile device over a period of time to recognize mobile device behaviors inconsistent with normal operation patterns, the method comprising: observing a mobile device behavior in an observer module in a privileged-normal portion of a secure operating environment of the mobile device; generating a concise behavior vector in the privileged-normal portion of the secure operating environment based on the observations; sending the concise behavior vector across a secure protection boundary of the secure operating environment of the mobile device by sending the concise behavior vector from the privileged-normal portion of the secure operating environment to an analyzer module in an unprivileged-secure portion of the secure operating environment; and determining whether the mobile device behavior may be classified as one of benign and non-benign based on a result of applying the concise behavior vector to a classifier model in the unprivileged-secure portion of the secure operating environment.