9. A computing device, comprising: means for receiving from a server computing device a full classifier model and sigmoid parameters; means for determining a normalized confidence value based on the received sigmoid parameters; and means for classifying a device behavior of the computing device based on a combination of: an analysis result generated by applying a behavior vector information structure to a lean classifier model; and the normalized confidence value determined based on the received sigmoid parameters.
16. The computing device of claim 9 , wherein means for receiving the full classifier model and the sigmoid parameters comprises means for receiving a finite state machine that includes information suitable for expression as two or more boosted decision stumps that each include a weight value and a test condition that is associated with a probability value that identifies a likelihood that the test condition will enable the computing device to determine whether the device behavior of the computing device is one of benign and non-benign.