1. A method of analyzing behaviors in a computing device, comprising: receiving, in a processor of the computing device from a server computing device, a full classifier model and sigmoid parameters; determining, via the processor, a normalized confidence value based on the received sigmoid parameters; and classifying, via the processor, a device behavior of the computing device based on a combination of: an analysis result generated by applying a behavior vector information structure to a lean classifier model; and the normalized confidence value determined based on the received sigmoid parameters.
1. A method of analyzing behaviors in a computing device, comprising: receiving, in a processor of the computing device from a server computing device, a full classifier model and sigmoid parameters; determining, via the processor, a normalized confidence value based on the received sigmoid parameters; and classifying, via the processor, a device behavior of the computing device based on a combination of: an analysis result generated by applying a behavior vector information structure to a lean classifier model; and the normalized confidence value determined based on the received sigmoid parameters. 6. The method of claim 1 , further comprising: generating an updated sigmoid parameter based on the normalized confidence value; and sending the updated sigmoid parameter to the server computing device.