1. A mobile device, comprising: a transceiver configured to establish a network connection; a cache memory; and a processor coupled to the transceiver and the cache memory, and configured with processor-executable instructions to perform operations comprising: populating the cache memory by: observing a first group of mobile device behaviors over a period of time; determining whether the cache memory stores a behavior vector that corresponds an observed mobile device behavior; and identifying a limited set of behaviors that are associated with operations that are inconsistent with normal operation patterns of the mobile device, receiving inputs regarding the limited set of behaviors, performing temporal and spatial correlations of the inputs, generating a first behavior vector based on a result of the spatial and temporal correlations, and storing the first behavior vector in the cache memory in response to determining that the cache memory does not store any behavior vectors that correspond to the observed mobile device behavior; and performing behavior-based analysis operations comprising: observing a second group of mobile device behaviors; generating a second behavior vector based on the second group of mobile device behaviors; determining whether the second behavior vector matches one of the behavior vectors stored in the cache memory; taking a corrective action in response to determining that the second behavior vector matches one of the behavior vectors stored in the cache memory; using the second behavior vector to determine whether one or more behaviors in the second group of mobile device behaviors are benign in response to determining that the second behavior vector does not match any of the behavior vectors stored in the cache memory; and storing the second behavior vector in the cache memory in response to determining that one or more behaviors in the second group of mobile device behaviors are not benign.