1. A method of analyzing behaviors in a computing device, comprising: receiving in a processor of the computing device from a server computing device a full classifier model and sigmoid parameters; determining a normalized confidence value based on the sigmoid parameters; and classifying a device behavior of the computing based on the normalized confidence value.