1. An analytics-based security monitoring system comprising: at least one memory to store instructions; and a hardware processor communicatively coupled to the at least one memory, the hardware processor, when executing the instructions, to: receive information collected from at least one computing node in a computing environment, detect a first plurality of behavioral characteristics from behavioral data in the received information, each of the first plurality of behavioral characteristics representing an action conducted in the computing environment, determine one or more behavioral fragments, each of the one or more behavioral fragments comprises a second plurality of behavioral characteristics having a level of relevance to each other that is computed based, at least in part, on one or more of (i) whether the second plurality of behavioral characteristics occur within a prescribed window of time or (ii) whether the second plurality of behavioral characteristics are detected on a single computing node or different computing nodes of the at least one computing node, correlate the one or more determined behavioral fragments against an attack profile comprising a plurality of sets of behavioral fragments where each set of behavioral fragments forms a malicious behavior pattern of a known attack, identify an attack based on the correlated one or more determined behavioral fragments, and perform one or more remedial actions when the attack is identified.