1. A method for observing computing device behaviors over a period of time via a processor of a computing device to recognize the computing device behaviors that are inconsistent with normal operation patterns of the computing device, the method comprising: dynamically selecting, via the processor, one or more computing device behaviors for observation; adaptively observing, via the processor, the dynamically selected computing device behaviors to collect behavior information; generating a vector data structure that succinctly describes the collected behavior information via a plurality of numbers; and using, by the processor, the vector data structure to identify a suspicious device behavior.