1. A method for observing mobile device behaviors over a period of time to recognize mobile device behaviors inconsistent with normal operation patterns, the method comprising: dynamically determining in a processor of a mobile device mobile device behaviors that are to be observed by: observing mobile device behaviors over the period of time; and identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed by: receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface (API) after filtering by an adaptive filter; receiving a context input regarding operations of the mobile device; performing spatial correlations of the received behavior inputs and the received context input; and generating a behavior vector; adaptively observing the determined mobile device behaviors to identify a suspicious mobile device behavior from a limited set of observations; and controlling an observation granularity of the adaptive observation.