ARCHITECTURE FOR CLIENT-CLOUD BEHAVIOR ANALYZER

A method of evaluating a mobile device behavior in stages, comprising: monitoring mobile device behaviors to generate observations; applying the observations to an initial reduced feature set model to determine whether the mobile device behavior is performance-degrading, benign, or suspicious; monitoring additional or different mobile device behaviors to generate refined observations when it is determined that the mobile device behavior is suspicious; and applying the refined observations to a subsequent reduced feature set model to determine whether the mobile device behavior is performance-degrading or benign as well as a corresponding mobile device, a corresponding method for a server and a corresponding server.