1. A method of analyzing mobile device behaviors in a mobile device to identify behaviors inconsistent with normal operation patterns of the mobile device, the method comprising: monitoring in a processor of the mobile device an activity of a software process; collecting behavior information from the monitored activity; generating a behavior vector based on the collected behavior information that characterizes the monitored activity; and applying the generated behavior vector to a machine learning classifier model on the mobile device to determine whether the software process is malicious.