1. A method for observing mobile device behaviors over a period of time to recognize mobile device behaviors inconsistent with normal operation patterns, the method comprising: determining in a processor of a mobile device a feature that is to be observed in the mobile device in order to identify a suspicious behavior of the mobile device; and adaptively observing the determined feature by collecting behavior information from an instrumented component associated with the determined feature.