1. A computer-implemented method, comprising: receiving a series of active process lists from a plurality of client devices at a server device; constructing a plurality of active process graphs based on the active process lists, wherein each client device is associated with an active process graph, wherein each node in each of the plurality of active process graphs corresponds to an active process on an associated client device, wherein each pair of connected nodes in each graph corresponds to a concurrence of an associated pair of active processes on an associated client device; and determining foreground processes based on the constructed active process graphs.