Patent Document ID: 10089582
Application ID: 14826430

Base Claim:
1. A method of analyzing behaviors in a computing device, comprising: receiving, in a processor of the computing device from a server computing device, a full classifier model and sigmoid parameters; determining, via the processor, a normalized confidence value based on the received sigmoid parameters; and classifying, via the processor, a device behavior of the computing device based on a combination of: an analysis result generated by applying a behavior vector information structure to a lean classifier model; and the normalized confidence value determined based on the received sigmoid parameters.

---

Claim 2:
2. The method of claim 1 , further comprising: generating a list of boosted decision stumps by converting a finite state machine included in the full classifier model into boosted decision stumps; and generating a family of lean classifier models based on the boosted decision stumps included in the list of boosted decision stumps, wherein classifying the device behavior of the computing device comprises: applying the behavior vector information structure to a first lean classifier model in the family of lean classifier models to generate the analysis result; and determining whether to apply the behavior vector information structure to a second lean classifier model in the family of lean classifier models to generate a new analysis result based on the normalized confidence value.