Adjustment of protection based on prediction and warning of malware-prone activity

A method of monitoring a protection level of a computing device comprising:

• setting an initial protection level;
• monitoring a user's activity on the computing device;
• comparing the user's activity with activity records in an activity database;
• identifying at least one activity record in the activity database that is similar to the user's activity;
• comparing a protection level of the at least one activity record with the initial protection level;
• and
• modifying the initial protection level when the initial protection level and the protection level of the at least one activity record are different.

A method for creating an activity database of activity records and an associated risk score for the activity record, comprising:

• receiving at least one activity record from at least one computing device, the activity record representing activity of a user of the at least one computing device;
• applying a similarity measure to a plurality of activity records that have been previously stored in the activity database and the at least one received activity record;
• identifying at least one activity record in the activity database that is similar to the received activity record;
• determining a risk score for the at least one received activity record based in part on a risk score associated with the at least one identified activity record in the activity database;
• and
• storing the received activity record along with the determined risk score in the activity database as a new activity record.