11. A computer program embedded in a non-transitory computer-readable storage medium, when executed by one or more processors, for securing a computer device, the computer program comprising: program instructions for receiving, by a security server, interaction data for a user interfacing with the computer device while the user is authenticated for accessing at least one computer resource, the interaction data including keyboard inputs, images taken of the user during the access and screen captures taken periodically; program instructions for performing optical character recognition (OCR) to identify text in the screen captures; program instructions for extracting semantic data from the interaction data and from the text in the screen captures, the semantic data identifying user activities associated with the interaction data; program instructions for generating a schema based on the extracted semantic data, the schema including tags that are descriptive of at least one of the identified user activity and the associated interaction data; program instructions for analyzing the schema based on a model to identify security threats associated with the user activities; program instructions for creating an alarm when non-conforming behavior for at least one user activity is detected, the alarm including a binding of the one or more user activities, one or more tags, keyboard inputs, and screen captures associated with the one or more user activities: and sending a command from the security server to terminate access to the at least one computer resource in response to the alarm.
18. The computer program as recited in claim 11 , wherein analyzing the schema further includes: program instructions for identifying a non-conforming behavior based on the model and a time of the non-conforming behavior.