1. A method of tracking data flows in a mobile device, comprising: identifying a data source component that inputs data into a software application configured for executing on a processing core of the mobile device; identifying a data sink component that consumes data output from the software application; using a measured runtime control-flow parameter to determine a probability value that identifies a likelihood that the data source component is a critical data resource; monitoring application programming interface (API) calls made by the software application when accessing the critical data resource; associating the probability value of the critical data resource with one or more of the API calls; identifying a pattern of API calls as being indicative of non-benign activity by the software application based on the probability value associated with the one or more of the API calls; generating a light-weight behavior signature based on the identified pattern of API calls; using the light-weight behavior signature to perform behavior analysis operations; and determining whether the software application is non-benign based on the behavior analysis operations.