1. A method of analyzing behaviors of a software application operating in a computing device, comprising: receiving in a processor of the computing device from a server device a behavior information structure that identifies a range of expected behaviors of the software application; monitoring activities of the software application on the computing device to collect local behavior information; using the local behavior information to generate a local behavior information structure that characterizes an observed behavior of the software application; comparing the generated local behavior information structure and the received behavior information structure to generate comparison results; using the generated comparison results to determine whether the observed behavior of the software application is within the range of expected behaviors of the software application; and applying the generated local behavior information structure to a classifier model to generate analysis results in response to determining, based on the generated comparison results, that the observed behavior of the software application is not within the range of expected behaviors of the software application.