1. A method for identifying a key logging activity, the method comprising: establishing a connection between a portable security computing device and a host computing device; identifying by the portable security computing device one or more processes running on the host computing device; identifying by the portable security computing device one or more hooking operations performed in the one or more identified processes; identifying by the portable security computing device one or more suspected key logging actions from the one or more identified hooking operations based on one or more of a first set of rules; and outputting by the portable security computing device the one or more identified suspected key logging actions.