11. The computing device of claim 9 , further comprising means for generating the lean classifier model based on the full classifier model.
9. A computing device, comprising: means for receiving from a server computing device a full classifier model and sigmoid parameters; means for determining a normalized confidence value based on the received sigmoid parameters; and means for classifying a device behavior of the computing device based on a combination of: an analysis result generated by applying a behavior vector information structure to a lean classifier model; and the normalized confidence value determined based on the received sigmoid parameters.