1. A method of determining an execution state of a software application or process in a mobile device, the method comprising: monitoring in a processor of the mobile device an activity of the software application or process to collect behavior information; using the collected behavior information to generate a behavior vector that describes the monitored activity via a series of numbers; applying a classifier model that includes a plurality of test conditions to the generated behavior vector to generate application-and-operating-system-agnostic execution state information; and using the application-and-operating-system-agnostic execution state information to determine the execution state of the software application or process.