Using normalized confidence values for classifying mobile device behaviors

• US 10,089,582 B2
• Filed: 08/14/2015
• Issued: 10/02/2018
• Est. Priority Date: 01/02/2013
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Fawaz, Kassem, Sridhara, Vinay, Gupta, Rajarshi, Chen, Yin
• Primary Examiner(s): Holmes, Michael B
• Application Number:
  US14/826,430
• Publication Number:
  US 20150356462A1
• Time in Patent Office: 1,145 Days
• Field of Search: 706 59
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/025 Extracting rules from data
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06N 5/043 Distributed expert systems; Blackboards

Abstract

Methods and systems for classifying mobile device behavior include generating a full classifier model that includes a finite state machine suitable for conversion into boosted decision stumps and/or which describes all or many of the features relevant to determining whether a mobile device behavior is benign or contributing to the mobile device'"'"'s degradation over time. A mobile device may receive the full classifier model along with sigmoid parameters and use the model to generate a full set of boosted decision stumps from which a more focused or lean classifier model is generated by culling the full set to a subset suitable for efficiently determining whether mobile device behavior are benign. Results of applying the focused or lean classifier model may be normalized using a sigmoid function, with the resulting normalized result used to determine whether the behavior is benign or non-benign.

Claims

1. A method of analyzing behaviors in a computing device, comprising:

receiving, in a processor of the computing device from a server computing device, a full classifier model and sigmoid parameters;

determining, via the processor, a normalized confidence value based on the received sigmoid parameters; and

classifying, via the processor, a device behavior of the computing device based on a combination of;

an analysis result generated by applying a behavior vector information structure to a lean classifier model; and

the normalized confidence value determined based on the received sigmoid parameters.

2. The method of claim 1, further comprising:

generating a list of boosted decision stumps by converting a finite state machine included in the full classifier model into boosted decision stumps; and

generating a family of lean classifier models based on the boosted decision stumps included in the list of boosted decision stumps,

wherein classifying the device behavior of the computing device comprises;

applying the behavior vector information structure to a first lean classifier model in the family of lean classifier models to generate the analysis result; and

determining whether to apply the behavior vector information structure to a second lean classifier model in the family of lean classifier models to generate a new analysis result based on the normalized confidence value.

3. The method of claim 1, further comprising generating the lean classifier model based on the full classifier model.

4. The method of claim 3, wherein generating the lean classifier model based on the full classifier model comprises:

generating a list of boosted decision stumps by converting a finite state machine included in the full classifier model into a plurality of boosted decision stumps;

determining a number of different test conditions that should be evaluated to classify the device behavior of the computing device without consuming an excessive amount of processing, memory, or energy resources of the computing device;

generating a list of test conditions by sequentially traversing the list of boosted decision stumps and inserting a test condition associated with each sequentially traversed boosted decision stump into the list of test conditions until the list of test conditions includes the number of different test conditions; and

generating the lean classifier model to include only those boosted decision stumps that test one of a plurality of test conditions included in the list of test conditions.

5. The method of claim 1, wherein classifying the device behavior of the computing device comprises:

applying collected behavior information included in the behavior vector information structure to each of a plurality of boosted decision stumps included in the lean classifier model;

computing a weighted average of a result of applying the collected behavior information to each of the plurality of boosted decision stumps included in the lean classifier model; and

classifying the device behavior of the computing device based on a result of comparing the weighted average to a threshold value.

6. The method of claim 1, further comprising:

generating an updated sigmoid parameter based on the normalized confidence value; and

sending the updated sigmoid parameter to the server computing device.

7. The method of claim 1, further comprising:

receiving an updated sigmoid parameter from the server computing device;

determining a new normalized confidence value based on the updated sigmoid parameter received from the server computing device; and

classifying the device behavior of the computing device based on the new normalized confidence value.

8. The method of claim 1, wherein receiving the full classifier model and the sigmoid parameters comprises receiving a finite state machine that includes information suitable for expression as two or more boosted decision stumps that each include a weight value and a test condition that is associated with a probability value that identifies a likelihood that the test condition will enable the computing device to determine whether the device behavior of the computing device is one of benign and non-benign.

9. A computing device, comprising:

means for receiving from a server computing device a full classifier model and sigmoid parameters;

means for determining a normalized confidence value based on the received sigmoid parameters; and

means for classifying a device behavior of the computing device based on a combination of;

an analysis result generated by applying a behavior vector information structure to a lean classifier model; and

the normalized confidence value determined based on the received sigmoid parameters.

10. The computing device of claim 9, further comprising:

means for generating a list of boosted decision stumps by converting a finite state machine included in the full classifier model into boosted decision stumps; and

means for generating a family of lean classifier models based on the boosted decision stumps included in the list of boosted decision stumps;

wherein means for classifying the device behavior of the computing device comprises;

means for applying the behavior vector information structure to a first lean classifier model in the family of lean classifier models to generate the analysis result; and

means for determining whether to apply the behavior vector information structure to a second lean classifier model in the family of lean classifier models to generate a new analysis result based on the normalized confidence value.

11. The computing device of claim 9, further comprising means for generating the lean classifier model based on the full classifier model.

12. The computing device of claim 11, wherein means for generating the lean classifier model based on the full classifier model comprises:

means for generating a list of boosted decision stumps by converting a finite state machine included in the full classifier model into a plurality of boosted decision stumps;

means for determining a number of different test conditions that should be evaluated to classify the device behavior of the computing device without consuming an excessive amount of processing, memory, or energy resources of the computing device;

means for generating a list of test conditions by sequentially traversing the list of boosted decision stumps and inserting a test condition associated with each sequentially traversed boosted decision stump into the list of test conditions until the list of test conditions includes the number of different test conditions; and

means for generating the lean classifier model to include only those boosted decision stumps that test one of a plurality of test conditions included in the list of test conditions.

13. The computing device of claim 9, wherein means for classifying the device behavior of the computing device comprises:

means for applying collected behavior information included in the behavior vector information structure to each of a plurality of boosted decision stumps included in the lean classifier model;

means for computing a weighted average of a result of applying the collected behavior information to each of the plurality of boosted decision stumps included in the lean classifier model; and

means for classifying the device behavior of the computing device based on a result of comparing the weighted average to a threshold value.

14. The computing device of claim 9, further comprising:

means for generating an updated sigmoid parameter based on the normalized confidence value; and

means for sending the updated sigmoid parameter to the server computing device.

15. The computing device of claim 9, further comprising:

means for receiving an updated sigmoid parameter from the server computing device;

means for determining a new normalized confidence value based on the updated sigmoid parameter; and

means for classifying the device behavior of the computing device based on the new normalized confidence value.

16. The computing device of claim 9, wherein means for receiving the full classifier model and the sigmoid parameters comprises means for receiving a finite state machine that includes information suitable for expression as two or more boosted decision stumps that each include a weight value and a test condition that is associated with a probability value that identifies a likelihood that the test condition will enable the computing device to determine whether the device behavior of the computing device is one of benign and non-benign.

17. A computing device, comprising:

a processor configured with processor-executable instructions to;

receive from a server computing device a full classifier model and sigmoid parameters;

determine a normalized confidence value based on the received sigmoid parameters; and

classify a device behavior of the computing device based on a combination of;

an analysis result generated by applying a behavior vector information structure to a lean classifier model; and

the normalized confidence value determined based on the received sigmoid parameters.

18. The computing device of claim 17, wherein the processor is further configured with processor-executable instructions to:

generate a list of boosted decision stumps by converting a finite state machine included in the full classifier model into boosted decision stumps; and

generate a family of lean classifier models based on the boosted decision stumps included in the list of boosted decision stumps, and wherein the processor is further configured with processor-executable instructions such that classifying the device behavior of the computing device is performed by;

applying the behavior vector information structure to a first lean classifier model in the family of lean classifier models to generate the analysis result; and

determining whether to apply the behavior vector information structure to a second lean classifier model in the family of lean classifier models to generate a new analysis result based on the normalized confidence value.

19. The computing device of claim 17, wherein:

the processor is further configured with processor-executable instructions to generate the lean classifier model based on the full classifier model.

20. The computing device of claim 19, wherein the processor is further configured with processor-executable instructions such that generating the lean classifier model based on the full classifier model is performed by:

generating a list of boosted decision stumps by converting a finite state machine included in the full classifier model into a plurality of boosted decision stumps;

determining a number of different test conditions that should be evaluated to classify the device behavior of the computing device without consuming an excessive amount of processing, memory, or energy resources of the computing device;

generating a list of test conditions by sequentially traversing the list of boosted decision stumps and inserting a test condition associated with each sequentially traversed boosted decision stump into the list of test conditions until the list of test conditions includes the number of different test conditions; and

generating the lean classifier model to include only those boosted decision stumps that test one of a plurality of test conditions included in the list of test conditions.

21. The computing device of claim 17, wherein the processor is further configured with processor-executable instructions such that classifying the device behavior of the computing device is performed by:

applying collected behavior information included in the behavior vector information structure to each of a plurality of boosted decision stumps included in the lean classifier model;

computing a weighted average of a result of applying the collected behavior information to each of the plurality of boosted decision stumps included in the lean classifier model; and

classifying the device behavior of the computing device based on a result of comparing the weighted average to a threshold value.

22. The computing device of claim 17, wherein the processor is further configured with processor-executable instructions to:

generate an updated sigmoid parameter based on the normalized confidence value; and

send the updated sigmoid parameter to the server computing device.

23. The computing device of claim 17, wherein the processor is further configured with processor-executable instructions to:

receive an updated sigmoid parameter from the server computing device;

determine a new normalized confidence value based on the updated sigmoid parameter; and

classify the device behavior of the computing device based on the new normalized confidence value.

24. The computing device of claim 17, wherein the processor is further configured with processor-executable instructions such that receiving the full classifier model and the sigmoid parameters is performed by receiving a finite state machine that includes information suitable for expression as two or more boosted decision stumps that each include a weight value and a test condition that is associated with a probability value that identifies a likelihood that the test condition will enable the processor to determine whether the device behavior of the computing device is one of benign and non-benign.

25. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor of a of a computing device to perform operations comprising:

receiving from a server computing device a full classifier model and sigmoid parameters;

determining a normalized confidence value based on the received sigmoid parameters; and

classifying a device behavior of the computing device based on a combination of;

an analysis result generated by applying a behavior vector information structure to a lean classifier model; and

the normalized confidence value determined based on the received sigmoid parameters the normalized confidence value.

26. The non-transitory computer readable storage medium of claim 25, wherein the stored processor-executable instructions are configured to cause the processor to perform operations further comprising:

generating a list of boosted decision stumps by converting a finite state machine included in the full classifier model into boosted decision stumps; and

generating a family of lean classifier models based on the boosted decision stumps included in the list of boosted decision stumps;

wherein classifying the device behavior of the computing device comprises;

applying the behavior vector information structure to a first lean classifier model in the family of lean classifier models to generate the analysis result; and

determining whether to apply the behavior vector information structure to a second lean classifier model in the family of lean classifier models to generate a new analysis result based on the normalized confidence value.

27. The non-transitory computer readable storage medium of claim 25, wherein the stored processor-executable instructions are configured to cause the processor to perform operations further comprising generating the lean classifier model based on the full classifier model.

28. The non-transitory computer readable storage medium of claim 27, wherein the stored processor-executable instructions are configured to cause the processor to perform operations such that generating the lean classifier model based on the full classifier model comprises:

generating a list of boosted decision stumps by converting a finite state machine included in the full classifier model into a plurality of boosted decision stumps;

determining a number of different test conditions that should be evaluated to classify the device behavior of the computing device without consuming an excessive amount of processing, memory, or energy resources of the computing device;

generating a list of test conditions by sequentially traversing the list of boosted decision stumps and inserting a test condition associated with each sequentially traversed boosted decision stump into the list of test conditions until the list of test conditions includes the number of different test conditions; and

generating the lean classifier model to include only those boosted decision stumps that test one of a plurality of test conditions included in the list of test conditions.

29. The non-transitory computer readable storage medium of claim 25, wherein the stored processor-executable instructions are configured to cause the processor to perform operations further comprising:

generating an updated sigmoid parameter based on the normalized confidence value; and

sending the updated sigmoid parameter to the server computing device.

30. The non-transitory computer readable storage medium of claim 25, wherein the stored processor-executable instructions are configured to cause the processor to perform operations further comprising:

receiving an updated sigmoid parameter from the server computing device;

determining a new normalized confidence value based on the updated sigmoid parameter; and

classifying the device behavior of the computing device based on the new normalized confidence value.