The invention is a system for protecting mobile devices in cellular networks from unauthorized harmful applications and for protecting cellular network infrastructure from targeted or benign overloads. The system comprises mobile cellular devices and a cellular network infrastructure. Some of the mobile devices comprise an application manager, which is adapted to manage the aggregation and learning processes, and a detection manager, which is adapted to analyze network behavior and detect deviations. The application manager and the detection manager are adapted to monitor the applications running on a device, learn the patterns of mobile applications network behavior and detect meaningful deviations from the application's observed normal behavior. The cellular network infrastructure comprises a services module, a logic module, and a database access unit adapted for aggregation and analysis of an application's network traffic patterns for numerous users.