19. The non-transitory computer readable storage medium of claim 18 , wherein the stored processor-executable software instructions are configured to use the collected behavior information to generate the vector information structure by generating the vector information structure to include information that may be input to of a decision node in the machine learning classifier model.
18. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor in a mobile device to: monitor an activity of a software process; collect behavior information from the monitored activity; use the collected behavior information to generate vector information structure, wherein: the vector information structure includes a plurality of numerical values, at least one numerical value in the plurality of numerical values identifies a number of occurrences of an action of the software process, at least one numerical value in the plurality of numerical values indicates a category for the software process based on an answer to a category query, and the plurality of numerical values collectively characterize the monitored activity; apply the vector information structure to a machine learning classifier model; and use a result generated by applying the vector information structure to the machine learning classifier model to determine whether the software process is non-benign.