1. A method of analyzing mobile device behaviors to identify a malicious software application, comprising: identifying in a processor a critical data resource that requires close monitoring; identifying an intermediate resource associated with the critical data resource; monitoring API calls made by a software application when accessing the critical data resource and the intermediate resource; identifying mobile device resources that are consumed or produced by the API calls; identifying a pattern of API calls as being indicative of malicious activity by the software application; generating a light-weight behavior signature based on the identified pattern of API calls and the identified mobile device resources; using the light-weight behavior signature to perform behavior analysis operations; and determining whether the software application is malicious or benign based on the behavior analysis operations.