Methods, devices and systems for monitoring behaviors of a mobile computing device include observing in a non-master processing core a portion of a mobile device behavior that is relevant to the non-master processing core, generating a behavior signature that describes the observed portion of the mobile device behavior, and sending the generated behavior signature to a master processing core. The master processing core combines two or more behavior signatures received from the non-master processing cores to generate a global behavior vector, which may be used by an analyzer module to determine whether a distributed software application is not benign.