1. A method for securing a computer device, the method comprising: capturing interaction data for a user interfacing with the computer device, the interaction data including keyboard inputs and screen captures taken periodically; extracting semantic meaning of the interaction data; generating a schema based on the extracted semantic meaning to create meaningful tags for the interaction data; analyzing the schema based on a model to identify security threats; and creating an alarm when non-conforming behavior for the model is detected, wherein operations of the method are executed by a processor.