1. A method of analyzing mobile device behaviors in a mobile device to identify behaviors inconsistent with normal operation patterns of the mobile device, the method comprising: monitoring, by a processor of the mobile device, an activity of a software process; collecting, by the processor, behavior information from the monitored activity; using, by the processor, the collected behavior information to generate a vector information structure, wherein: the generated vector information structure includes a plurality of numerical values, at least one numerical value in the plurality of numerical values identifies a number of occurrences of an action of the software process, at least one numerical value in the plurality of numerical values indicates a category for the software process based on an answer to a category query, and the plurality of numerical values collectively characterize the monitored activity; applying, by the processor, the generated vector information structure to a machine learning classifier model; and using, by the processor, a result generated by applying the generated vector information structure to the machine learning classifier model to determine whether the software process is non-benign.
1. A method of analyzing mobile device behaviors in a mobile device to identify behaviors inconsistent with normal operation patterns of the mobile device, the method comprising: monitoring, by a processor of the mobile device, an activity of a software process; collecting, by the processor, behavior information from the monitored activity; using, by the processor, the collected behavior information to generate a vector information structure, wherein: the generated vector information structure includes a plurality of numerical values, at least one numerical value in the plurality of numerical values identifies a number of occurrences of an action of the software process, at least one numerical value in the plurality of numerical values indicates a category for the software process based on an answer to a category query, and the plurality of numerical values collectively characterize the monitored activity; applying, by the processor, the generated vector information structure to a machine learning classifier model; and using, by the processor, a result generated by applying the generated vector information structure to the machine learning classifier model to determine whether the software process is non-benign. 4. The method of claim 1 , wherein generating the vector information structure comprises generating a vector that includes information suitable for generating answers to at least one of: an existence query; an amount query; an order query; or the category query.