Abstract. Current measures to enhance the security of untrusted mobile applications require a user to trust the software vendor. They do not guarantee complete protection against the behaviours that mobile malware commonly exhibits. This paper expands execution monitoring, building a more precise system to prevent mobile applications deviating from their intended functions. gements about program execution can be specified abstractly and compiled into a monitor capable of identifying an event’s context. We demonstrate our development of a prototype system for the BlackBerry platform and show how it can defend the device against unseen malware more effectively than existing security tools.