10. A mobile computing device comprising: a hardware processor configured with processor-executable instructions to: monitor an activity of a software process; collect behavior information from the monitored activity; use the collected behavior information to generate a vector information structure, wherein: the generated vector information structure includes a plurality of numerical values, at least one numerical value in the plurality of numerical values identifies a number of occurrences of an action of the software process, at least one numerical value in the plurality of numerical values indicates a category for the software process based on an answer to a category query, and the plurality of numerical values collectively characterize the monitored activity; apply the generated vector information structure to a machine learning classifier model; and use a result generated by applying the generated vector information structure to the machine learning classifier model to determine whether the software process is non-benign.
10. A mobile computing device comprising: a hardware processor configured with processor-executable instructions to: monitor an activity of a software process; collect behavior information from the monitored activity; use the collected behavior information to generate a vector information structure, wherein: the generated vector information structure includes a plurality of numerical values, at least one numerical value in the plurality of numerical values identifies a number of occurrences of an action of the software process, at least one numerical value in the plurality of numerical values indicates a category for the software process based on an answer to a category query, and the plurality of numerical values collectively characterize the monitored activity; apply the generated vector information structure to a machine learning classifier model; and use a result generated by applying the generated vector information structure to the machine learning classifier model to determine whether the software process is non-benign. 11. The mobile computing device of claim 10 , wherein the processor is configured with processor-executable instructions to use the collected behavior information to generate the vector information structure by generating the vector information structure to include information that may be input to a decision node in the machine learning classifier model.