Intrusion detection on computing devices

A non-transitory computer readable storage medium including instructions that, when executed by a computing system, cause the computing system to perform operations comprising:

• performing behavioral analysis continuously by:
• collecting, by a processing device, raw data regarding a user action;
• converting, by the processing device, the raw data to characteristic test data (CTD), wherein the CTD represents one or more behavior characteristics of a current user;
• identifying, by the processing device, a characteristic model corresponding to the one or more behavior characteristics represented by the CTD;
• and
• generating, by the processing device, a predictor from a comparison of the CTD against the corresponding characteristic model, wherein the predictor comprises a score indicating a probability that the user action is permitted;
• at a given time, and based on a factor, automatically adjusting a threshold for determining whether the score indicates a probability that the user action is permitted, wherein the factor is one of:
• the user action occurring in an area of a system that has a particular security requirement, the user action occurring at a given time, the user action associated with a given information request, an extent to which the user action is continuous, and a quality of an available characteristic model;
• at the given time and based on the adjusted threshold, applying the corresponding characteristic model for the given CTD to generate the score;
• and
• taking an access control action based on the score.

A computing system, comprising:

• a data storage device;
• and
• a processing device, coupled to the data storage device, to:
• collect raw data regarding a user action;
• convert the raw data to characteristic test data (CTD), wherein the CTD represents one or more behavior characteristics of a current user;
• identify a characteristic model corresponding to the one or more behavior characteristics represented by the CTD;
• and
• generate a predictor from a comparison of the CTD against the corresponding characteristic model, wherein the predictor comprises a score indicating a probability that the user action is permitted, the collecting, converting, identifying and generating operations carried out continuously as a behavioral analysis;
• at a given time, and based on a factor, automatically adjust a threshold for determining whether the score indicates a probability that the user action is permitted, wherein the factor is one of:
• the user action occurring in an area of a system that has a particular security requirement, the user action occurring at a given time, the user action associated with a given information request, an extent to which the user action is continuous, and a quality of an available characteristic model;
• at the given time and based on the adjusted threshold, apply the corresponding characteristic model for the given CTD to generate the score;
• and
• take an access control action based on the score.