1. A method for securing a computer device, the method comprising: receiving, by a security server, interaction data for a user interfacing with the computer device while the user is authenticated for accessing at least one computer resource, the interaction data including keyboard inputs, images taken of the user during the access and screen captures taken periodically; performing optical character recognition (OCR) to identify text in the screen captures; extracting semantic data from the interaction data and from the text in the screen captures, the semantic data identifying user activities associated with the interaction data; generating a schema based on the extracted semantic data, the schema including tags that are descriptive of at least one of the identified user activity and the associated interaction data; analyzing the schema based on a model to identify security threats associated with the user activities; creating an alarm when non-conforming behavior for at least one user activity is detected, the alarm including a binding of the one or more user activities, one or more tags, keyboard inputs, and screen captures associated with the one or more user activities; and sending a command from the security server to terminate access to the at least one computer resource in response to the alarm, wherein operations of the method are executed by a processor.