1. A method for behavior-based malware detection on a device comprising: detecting one or more system calls in an application kernel of the device; monitoring at least one user input event and at least one display event associated with said one or more system calls; constructing a behavior graph based on said one or more system calls, said at least one user input event, and said at least one display event; observing one or more event pairs in the behavior graph, wherein each event pair comprises a user input event that is correlated with a display event; based on said one or more event pairs, extracting user-behavior features from the behavior graph, wherein said user-behavior features comprise one or more acceptable user behavioral patterns and transition information relating to said one or more event pairs; storing said extracted user-behavior features in a user profile; and detecting unauthorized use of the device by detecting a deviation from said one or more acceptable user behavioral patterns stored in the user profile.