1. A method of analyzing behaviors in a computing device, comprising: receiving, in a processor of the computing device from a server computing device, a full classifier model and sigmoid parameters; determining, via the processor, a normalized confidence value based on the received sigmoid parameters; and classifying, via the processor, a device behavior of the computing device based on a combination of: an analysis result generated by applying a behavior vector information structure to a lean classifier model; and the normalized confidence value determined based on the received sigmoid parameters.