17. A computing device, comprising: a processor configured with processor-executable instructions to: receive from a server computing device a full classifier model and sigmoid parameters; determine a normalized confidence value based on the received sigmoid parameters; and classify a device behavior of the computing device based on a combination of: an analysis result generated by applying a behavior vector information structure to a lean classifier model; and the normalized confidence value determined based on the received sigmoid parameters.
21. The computing device of claim 17 , wherein the processor is further configured with processor-executable instructions such that classifying the device behavior of the computing device is performed by: applying collected behavior information included in the behavior vector information structure to each of a plurality of boosted decision stumps included in the lean classifier model; computing a weighted average of a result of applying the collected behavior information to each of the plurality of boosted decision stumps included in the lean classifier model; and classifying the device behavior of the computing device based on a result of comparing the weighted average to a threshold value.