1. A method of detecting side channel attacks in a computing device, comprising: receiving a full classifier model that includes a plurality of decision nodes; monitoring an activity of the computing device over a time period to collect behavior information; using the collected behavior information to generate a behavior vector information structure that includes a plurality of numerical values that characterize the monitored activity; culling the received full classifier model to generate a lean classifier model; applying the generated behavior vector information structure to the lean classifier model, the lean classifier model including a plurality of decision nodes that collectively test a plurality of different conditions in the computing device, each decision node including a weight value and a corresponding test condition, each weight value indicating a likelihood that an answer to the corresponding test condition will allow the computing device to determine whether a side channel attack is underway; and determining whether the side channel attack is underway based on analysis results generated by applying the generated behavior vector information structure to the lean classifier model.