1. A method of detecting malware in a mobile telecommunications device, the method comprising: maintaining a database of legitimate applications and their respective expected behaviours; identifying legitimate applications running on the device; monitoring the behaviour of the device, comparing this monitored behaviour with that expected according to the database for those legitimate applications identified as running on the device; and analyzing deviations from the expected behaviour of the device to identify the potential presence of malware.