1. A method for observing mobile device behaviors over a period of time to recognize mobile device behaviors inconsistent with normal operation patterns, the method comprising: dynamically determining in a processor which mobile device behaviors are to be observed; and adaptively observing the determined mobile device behaviors to identify a suspicious mobile device behavior from a limited set of observations.