Abstract: During operation, an electronic device may receive user information associated with a user. Then, the electronic device may provide, to a computer system, the user information. Moreover, the electronic device may receive, from the computer system, a pretrained predictive model associated with the user. Furthermore, the electronic device may monitor activity associated with an event while the user uses the electronic device, where the activity includes a hardware activity and/or a software activity. Next, the electronic device may analyze the activity using the pretrained predictive model to identify the event, and may provide, to the computer system, event information specifying a process, which is associated with the event. Additionally, the electronic device may receive, from the computer system, severity information that indicates a security risk associated with the event. Based at least in part on the severity information, the electronic device may selectively perform a remedial action.

Abstract: Computer-implemented security techniques and a respective system for detecting a computer-system anomaly behavior before, during and/or after operations is described. These network-security may use instances of an agent that resides in every host-monitored computer or electronic device (such as a portable computer or a cellular telephone) and a network-security computer that is associated with an organization, and which is located on premises and/or in the cloud. Notably, the instances of the agent may monitor complicated system behavior and may report first detection of behavioral anomalies to the network-security computer. Then, the network-security computer may perform a remedial action based at least in part on the first detection of the behavioral anomalies.