Behavioral analysis for securing peripheral devices

• US 10,176,428 B2
• Filed: 03/13/2014
• Issued: 01/08/2019
• Est. Priority Date: 03/13/2014
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Sridhara, Vinay, Gupta, Rajarshi
• Primary Examiner(s): Sitiriche, Luis A
• Application Number:
  US14/207,754
• Publication Number:
  US 20150262067A1
• Time in Patent Office: 1,762 Days
• Field of Search: None
• CPC Class Codes: G06F 11/0742 in a data processing system embedded in a mobile device, e.g. mobile phones, handheld devices
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/3013 where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems testing or monitoring of control systems or parts thereof G05B23/02
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 20/20 Ensemble learning
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06N 99/00 Subject matter not provided for in other groups of this subclass
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

The various aspects configure a mobile computing device to efficiently identify, classify, model, prevent, and/or correct the conditions and/or behaviors occurring on the mobile computing device that are related to one or more peripheral devices connected to the mobile computing device and that often degrade the performance and/or power utilization levels of the mobile computing device over time. In the various aspects, the mobile computing device may obtain a classifier model that includes, tests, and/or evaluates various conditions, features, behaviors and corrective actions on the mobile computing device that are related to one or more peripheral devices connected to the mobile computing device. The mobile computing device may utilize the classifier model to quickly identify and correct undesirable behaviors occurring on the mobile computing device that are related to the one or more connected peripheral devices.

Claims

1. A method of analyzing behaviors in a mobile computing device connected to a peripheral device, comprising:

identifying a capability related to the peripheral device connected to the mobile computing device;

determining a feature on the mobile computing device related to the identified capability;

generating, via a processor of the mobile computing device, a classifier model based on the determined feature, wherein the classifier model includes decision stumps that evaluate features of the mobile computing device related to the peripheral device, wherein each decision stump is a one level decision tree that includes a single node and a weight value, wherein the single node tests a condition related to a mobile device feature that is present in the mobile computing device due to the connected peripheral device;

observing, via the processor, mobile device behaviors related to the peripheral device to collect behavior information;

generating, via the processor, a behavior vector for a configuration of the mobile computing device based on the collected behavior information;

applying, via the processor, the generated behavior vector to the generated classifier model to generate a result;

using, via the processor, the generated result to determine whether one of the observed behaviors is an undesirable behavior; and

terminating the undesirable behavior on the mobile computing device in response to determining that one of the observed behaviors is an undesirable behavior.

2. The method of claim 1, wherein using the generated result to determine whether one of the observed behaviors is the undesirable behavior comprises using the generated result to determine whether one of the observed behaviors is:

an undesirable behavior occurring on the mobile computing device and caused by the peripheral device;

or

an undesirable behavior caused by activities occurring on both of the mobile computing device and the peripheral device.

3. The method of claim 1, wherein generating the classifier model based on the determined feature comprises:

observing behaviors on the mobile computing device related to the peripheral device over a period of time;

identifying a behavior related to the peripheral device that is expected to occur based on behaviors observed on the mobile computing device over the period of time;

determining a set of features on the mobile computing device related to the expected behavior; and

generating the classifier model based on the determined set of features related to the expected behavior.

4. The method of claim 1, wherein generating the classifier model based on the determined feature comprises:

receiving a full classifier model generated on a server from a cloud data set of information provided by a plurality of mobile computing devices;

generating a lean classifier model comprising features relevant to the mobile computing device;

and

modifying the lean classifier model to include the determined feature related to the peripheral device.

5. The method of claim 1, further comprising receiving from the peripheral device observations of behaviors occurring on the peripheral device,

wherein generating the behavior vector for the configuration of the mobile computing device comprises generating the behavior vector based on the collected behavior information and the observations received from the peripheral device.

6. The method of claim 1, wherein observing the mobile device behaviors related to the peripheral device to collect the behavior information further comprises monitoring communications between the mobile computing device and the peripheral device, and inputs received from the peripheral device, to collect the behavior information.

7. A mobile computing device, comprising:

a memory; and

a processor coupled to the memory, and configured with processor-executable instructions to perform operations comprising;

identifying a capability related to a peripheral device connected to the mobile computing device;

determining a feature on the mobile computing device related to the identified capability;

generating a classifier model based on the determined feature, wherein the classifier model includes decision stumps that evaluate features of the mobile computing device related to the peripheral device connected to the mobile computing device, wherein each decision stump is a one level decision tree that includes a single node and a weight value, wherein the single node tests a condition related to a mobile device feature that is present in the mobile computing device due to the connected peripheral device;

observing mobile device behaviors related to the peripheral device to collect behavior information;

generating a behavior vector for a configuration of the mobile computing device based on the collected behavior information;

applying the generated behavior vector to the generated classifier model to generate a result;

using the generated result to determine whether one of the observed behaviors is an undesirable behavior; and

terminating the undesirable behavior on the mobile computing device in response to determining that one of the observed behaviors is an undesirable behavior.

8. The mobile computing device of claim 7, wherein the processor is configured with processor-executable instructions to perform operations such that using the generated result to determine whether one of the observed behaviors is the undesirable behavior comprises using the generated result to determine whether one of the observed behaviors is:

an undesirable behavior occurring on the mobile computing device and caused by the peripheral device;

or

an undesirable behavior caused by activities occurring on both of the mobile computing device and the peripheral device.

9. The mobile computing device of claim 7, wherein the processor is configured with processor-executable instructions to perform operations such that generating the classifier model based on the determined feature comprises:

observing behaviors on the mobile computing device related to the peripheral device over a period of time;

identifying a behavior related to the peripheral device that is expected to occur based on behaviors observed on the mobile computing device over the period of time;

determining a set of features on the mobile computing device related to the expected behavior; and

generating the classifier model based on the determined set of features related to the expected behavior.

10. The mobile computing device of claim 7, wherein the processor is configured with processor-executable instructions to perform operations such that generating the classifier model based on the determined feature comprises:

receiving a full classifier model generated on a server from a cloud data set of information provided by a plurality of mobile computing devices;

generating a lean classifier model comprising features relevant to the mobile computing device;

and

modifying the lean classifier model to include the determined feature related to the peripheral device.

11. The mobile computing device of claim 7, wherein:

the processor is configured with processor-executable instructions to perform operations further comprising receiving from the peripheral device observations of behaviors occurring on the peripheral device; and

the processor is configured with processor-executable instructions to perform operations such that generating the behavior vector for the configuration of the mobile computing device comprises generating the behavior vector based on the collected behavior information and the observations received from the peripheral device.

12. The mobile computing device of claim 7, wherein:

the processor is configured with processor-executable instructions to perform operations such that observing the mobile device behaviors related to the peripheral device to collect the behavior information further comprises monitoring communications between the mobile computing device and the peripheral device, and inputs received from the peripheral device, to collect the behavior information.

13. A mobile computing device, comprising:

means for identifying a capability related to a peripheral device connected to the mobile computing device;

means for determining a feature on the mobile computing device related to the identified capability;

means for generating a classifier model based on the determined feature includes decision stumps that evaluate features of the mobile computing device related to the peripheral device connected to the mobile computing device, wherein each decision stump is a one level decision tree that includes a single node and a weight value, wherein the single node tests a condition related to a mobile device feature that is present in the mobile computing device due to the connected peripheral device;

means for observing mobile device behaviors related to the peripheral device to collect behavior information;

means for generating a behavior vector for a configuration of the mobile computing device based on the collected behavior information;

means for applying the generated behavior vector to the generated classifier model to generate a result;

means for using the generated result to determine whether one of the observed behaviors is an undesirable behavior; and

means for terminating the undesirable behavior on the mobile computing device in response to determining that one of the observed behaviors is an undesirable behavior.

14. The mobile computing device of claim 13, wherein means for using the generated result to determine whether one of the observed behaviors is the undesirable behavior comprises means for using the generated result to determine whether one of the observed behaviors is:

an undesirable behavior occurring on the mobile computing device and caused by the peripheral device;

or

an undesirable behavior caused by activities occurring on both of the mobile computing device and the peripheral device.

15. The mobile computing device of claim 13, wherein means for generating the classifier model based on the determined feature comprises:

means for observing behaviors on the mobile computing device related to the peripheral device over a period of time;

means for identifying a behavior related to the peripheral device that is expected to occur based on behaviors observed on the mobile computing device over the period of time;

means for determining a set of features on the mobile computing device related to the expected behavior; and

means for generating the classifier model based on the determined set of features related to the expected behavior.

16. The mobile computing device of claim 13, wherein means for generating the classifier model based on the determined feature comprises:

means for receiving a full classifier model generated on a server from a cloud data set of information provided by a plurality of mobile computing devices;

means for generating a lean classifier model comprising features relevant to the mobile computing device;

and

means for modifying the lean classifier model to include the determined feature related to the peripheral device.

17. The mobile computing device of claim 13, further comprising means for receiving from the peripheral device observations of behaviors occurring on the peripheral device,

wherein means for generating the behavior vector for the configuration of the mobile computing device comprises means for generating the behavior vector based on the collected behavior information and the observations received from the peripheral device.

18. The mobile computing device of claim 13, wherein means for observing the mobile device behaviors related to the peripheral device to collect the behavior information further comprises means for monitoring communications between the mobile computing device and the peripheral device, and inputs received from the peripheral device, to collect the behavior information.

19. A non-transitory computer-readable storage medium having stored thereon processor-executable software instructions configured to cause a processor of a mobile computing device to perform operations comprising:

identifying a capability related to the peripheral device connected to the mobile computing device;

determining a feature on the mobile computing device related to the identified capability;

generating a classifier model based on the determined feature includes decision stumps that evaluate features of the mobile computing device related to the peripheral device connected to the mobile computing device, wherein each decision stump is a one level decision tree that includes a single node and a weight value, wherein the single node tests a condition related to a mobile device feature that is present in the mobile computing device due to the connected peripheral device;

observing mobile device behaviors related to the peripheral device to collect behavior information;

generating a behavior vector for a configuration of the mobile computing device based on the collected behavior information;

applying the generated behavior vector to the generated classifier model to generate a result;

using the generated result to determine whether one of the observed behaviors is an undesirable behavior; and

terminating the undesirable behavior on the mobile computing device in response to determining that one of the observed behaviors is an undesirable behavior.

20. The non-transitory computer-readable storage medium of claim 19, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that using the generated result to determine whether one of the observed behaviors is the undesirable behavior comprises using the generated result to determine whether one of the observed behaviors is:

an undesirable behavior occurring on the mobile computing device and caused by the peripheral device;

or

an undesirable behavior caused by activities occurring on both of the mobile computing device and the peripheral device.

21. The non-transitory computer-readable storage medium of claim 19, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that generating the classifier model based on the determined feature comprises:

observing behaviors on the mobile computing device related to the peripheral device over a period of time;

identifying a behavior related to the peripheral device that is expected to occur based on behaviors observed on the mobile computing device over the period of time;

determining a set of features on the mobile computing device related to the expected behavior; and

generating the classifier model based on the determined set of features related to the expected behavior.

22. The non-transitory computer-readable storage medium of claim 19, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that generating the classifier model based on the determined feature comprises:

receiving a full classifier model generated on a server from a cloud data set of information provided by a plurality of mobile computing devices;

generating a lean classifier model comprising features relevant to the mobile computing device;

and

modifying the lean classifier model to include the determined feature related to the peripheral device.

23. The non-transitory computer-readable storage medium of claim 19, wherein:

the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising receiving from the peripheral device observations of behaviors occurring on the peripheral device; and

the stored processor-executable software instructions are configured to cause a processor to perform operations such that generating the behavior vector for the configuration of the mobile computing device comprises generating the behavior vector based on the collected behavior information and the observations received from the peripheral device.

24. The non-transitory computer-readable storage medium of claim 19, wherein:

the stored processor-executable software instructions are configured to cause a processor to perform operations such that observing the mobile device behaviors related to the peripheral device to collect the behavior information further comprises monitoring communications between the mobile computing device and the peripheral device, and inputs received from the peripheral device, to collect the behavior information.