1. A method for detecting malware on a mobile device, the method comprising: detecting a page fault caused by a memory page on a guest domain of the mobile device; recording the page fault in a page table on a host domain of the mobile device; applying a rule to the page fault, the rule identifying one or more matching pages; retrieving the one or more matching pages from the guest domain; and transmitting the one or more matching pages along with the memory page to a remote server for analysis.