Determination of sensor usage

• US 10,659,479 B2
• Filed: 03/27/2015
• Issued: 05/19/2020
• Est. Priority Date: 03/27/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Hinchliffe, Alexander J., Passera, Pablo R., Jidigam, Ranjith Kumar, Yeung, Alger Wan Kwong, Hunt, Simon
• Primary Examiner(s): Lemma, Samson B
• Assistant Examiner(s): Cruz-Franqui, Richard W
• Application Number:
  US14/672,059
• Publication Number:
  US 20160285903A1
• Time in Patent Office: 1,880 Days
• CPC Class Codes: G06F 16/24568 Data stream processing; Continuous queries
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

Particular embodiments may include a system, apparatus, method, and/or machine readable storage medium for determining sensor usage by: detecting, at a level below an operating system executing on a computing device, one or more requests from an application to access one or more sensors associated with the computing device; determining, based on the one or more requests from the application to access the one or more sensors, that the application requested unexpected access to the one or more sensors; and performing a remedial action in response to the unexpected access requested by the application.

Claims

1. At least one non-transitory machine readable storage medium comprising one or more instructions that, when executed by at least one processor, cause the at least one processor to perform a method comprising:

hooking, at a level below an operating system that executes on a computing device, one or more requests to produce hooked one or more requests, wherein the one or more requests are from an application to access one or more sensors included in the computing device, and the one or more sensors include an accelerometer, a gravity sensor, a gyroscope, a rotational vector sensor, a barometer, a photometer, a thermometer, an orientation sensor, a magnetometer, a microphone, or a global positioning sensor;

identifying, based on the hooked one or more requests, the application and the one or more sensors;

hooking a kernel to monitor a use by the application of the one or more sensors from an operating system level application program interface to log data related to the hooked one or more requests to produce logged data in a storage structure;

comparing the logged data in the storage structure to the hooked one or more requests to identify when there is a discrepancy; and

performing a remedial action when there is the discrepancy.

2. The at least one machine readable storage medium of claim 1, wherein the remedial action is a notification of a user of the access requested by the application.

3. The at least one machine readable storage medium of claim 1, the method further comprising:

receiving a reputation rating for the application from a network element, wherein the reputation rating is based on logged sensor request information for the application; and

notifying a user of the reputation rating.

4. The at least one machine readable storage medium of claim 1, wherein the remedial action is a blocking of access from the application to the one or more sensors.

5. The at least one machine readable storage medium of claim 1, the method further comprising:

communicating one or more requests by the application to the operating system level application program interface to access the one or more sensors.

6. The at least one machine readable storage medium of claim 1, wherein the remedial action is sending an alert.

7. An apparatus for determining sensor usage, comprising:

a hardware processor configured to

hook, at a level below an operating system that executes on the apparatus, one or more requests to produce hooked one or more requests, wherein the one or more requests are from an application to access one or more sensors included in the apparatus, and the one or more sensors include an accelerometer, a gravity sensor, a gyroscope, a rotational vector sensor, a barometer, a photometer, a thermometer, an orientation sensor, a magnetometer, a microphone, or a global positioning sensor;

identify, based on the hooked one or more requests, the application and the one or more sensors;

hook a kernel to monitor a use by the application of the one or more sensors from an operating system level application program interface to log data related to the hooked one or more requests to produce logged data in a storage structure;

compare the logged data in the storage structure to the hooked one or more requests to identify when there is a discrepancy; and

perform a remedial action when there is the discrepancy.

8. The apparatus of claim 7, wherein the processor is further configured to receive a reputation rating for the application from a network element, wherein the reputation rating is based on logged sensor request information for the application, and to notify a user of the reputation rating.

9. The apparatus of claim 7, wherein the remedial action is a notification of a user of the access requested by the application.

10. The apparatus of claim 7, wherein the one or more sensors at least derive data from a hardware-based sensor.

11. The apparatus of claim 7, wherein the one or more sensors measure an acceleration, a geomagnetic field strength, or an angular change.

12. The apparatus of claim 7, wherein the request to access the one or more sensors is communicated to a kernel driver.

13. A method, comprising:

hooking, at a level below an operating system that executes on a computing device, one or more requests to produce hooked one or more requests, wherein the one or more requests are from an application to access one or more sensors included in the computing device, and the one or more sensors include an accelerometer, a gravity sensor, a gyroscope, a rotational vector sensor, a barometer, a photometer, a thermometer, an orientation sensor, a magnetometer, a microphone, or a global positioning sensor;

identifying, based on the hooked one or more requests, the application and the one or more sensors;

hooking a kernel to monitor a use by the application of the one or more sensors from an operating system level application program interface to log data related to the hooked one or more requests to produce logged data in a storage structure;

comparing the logged data in the storage structure to the hooked one or more requests to identify when there is a discrepancy; and

performing a remedial action when there is the discrepancy.

14. The method of claim 13, further comprising

receiving a reputation rating for the application from a network element, wherein the reputation rating is based on logged sensor request information for the application;

and

notifying a user of the reputation rating.

15. The method of claim 13, wherein the remedial action is a notification of a user of the access requested by the application.

16. A system for determining sensor usage, comprising:

a processor;

a memory; and

logic stored in the memory, wherein the logic, when executed by the processor, is configured to

hook, at a level below an operating system that executes on the system, one or more requests to produce hooked one or more requests, wherein the one or more requests are from an application to access one or more sensors included in the system, wherein the one or more sensors include an accelerometer, a gravity sensor, a gyroscope, a rotational vector sensor, a barometer, a photometer, a thermometer, an orientation sensor, a magnetometer, a microphone, or a global positioning sensor;

identify, based on the hooked one or more requests, the application and the one or more sensors;

hook a kernel to monitor a use by the application of the one or more sensors from an operating system level application program interface to log data related to the hooked one or more requests to produce logged data in a storage structure;

compare the logged data in the storage structure to the hooked one or more requests to identify when there is a discrepancy; and

perform a remedial action when there is the discrepancy.

17. The system of claim 16, wherein the remedial action is a notification of a user of the access requested by the application.

18. The system of claim 16, wherein the one or more sensors at least derive data from a hardware-based sensor.