1. A method of providing malware protection on a mobile device, the method comprising: creating a traffic signature by monitoring data traffic associated with the mobile device; creating a behavior signature by monitoring behavior information based on non-traffic data associated with the mobile device; creating a device activity signature that includes the traffic signature and the behavior signature; determining a classification of the device activity signature; and applying a policy decision for the mobile device based on the determined classification, wherein the policy decision includes blocking activity associated with an application.