1. A method comprising: generating a behavioral model configured to describe one or more interactions associated with a protected data accessible by way of a computing device; determining an attempt to access the protected data is abnormal based, at least in part, on a comparison between the attempt to access the protected data and the behavioral model; determining the abnormal attempt to access the protected data is a malicious process based, at least in part, on a determined degree of variation from the behavioral model; and causing, by a processor, the malicious process to be remediated with respect to the computing device.