1. A method of analyzing a device behavior in a computing device, comprising: monitoring by a processor of the computing device activities of a software application operating on the computing device to generate user-persona information that characterizes a user of the computing device; and using the user-persona information to determine whether the device behavior is non-benign.