1. A method comprising: monitoring data traffic and other activity associated with a computing device; creating a device activity signature of the data traffic and other device behavior that includes an abstraction of the activity and data traffic; determining a classification of the device activity signature; and applying a policy decision for the computing device based on the determined classification.