1. A method of monitoring and analyzing behaviors in a computing device having a high level operating system and a secure computing environment, comprising: executing a first process via one or more hardware processors of the computing device in a privileged-normal portion of the secure computing environment of the computing device, the first process monitoring device behaviors over a period of time to collect behavior information and using the behavior information to generate a behavior vector; executing a second process via the one or more hardware processors of the computing device in an unprivileged-normal portion of the secure computing environment of the computing device; executing a secure authentication process via the one or more hardware processors in a privileged-secure portion of the secure computing environment of the computing device; the first process providing a communication request message to the secure authentication process executing in the privileged-secure portion at the same or higher privilege level and at a higher security level than the first process; the secure authentication process using the information included in the communication request message to authenticate the first process in the privileged-secure portion of the computing device; the secure authentication process performing an integrity check of the first process in the privileged-secure portion of the computing device, the integrity check including the secure authentication process accessing a portion of a memory of the computing device allocated to the first process by the high level operating system to generate a cryptographic measurement in the privileged-secure portion; the secure authentication process generating a key that includes the generated cryptographic measurement in response to the secure authentication process successfully authenticating the first process and the secure authentication process successfully performing the integrity check of the first process; the secure authentication process in the privileged-secure portion providing the generated key to the first process in the privileged-normal portion; the first process in the privileged-normal portion providing a second communication request message that includes the generated behavior vector and the generated key to the second process executing in the unprivileged-normal portion of the secure computing environment of the computing device; the second process authenticating the first process based on the key and the cryptographic measurement included in the key to determine whether the first process can be trusted; and the second process analyzing the behavior vector included in the second communication request message received from the first process to determine whether a behavior is benign in response to the second process determining, based on the key and the cryptographic measurement included in the key, that the first process can be trusted.