COLLABORATIVE LEARNING FOR EFFICIENT BEHAVIORAL ANALYSIS IN NETWORKED MOBILE DEVICE

• US 20130303159A1
• Filed: 03/14/2013
• Published: 11/14/2013
• Est. Priority Date: 05/14/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Gupta, Rajarshi, Gathala, Anil
• Granted Patent: US 9,298,494 B2
• Time in Patent Office: Days
• US Class Current: 455/425
• CPC Class Codes: G06F 11/3013 where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems testing or monitoring of control systems or parts thereof G05B23/02
• CPC Class Codes: G06F 11/3062 where the monitored property is the power consumption power management in a computing system G06F1/3203
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: G06N 5/043 Distributed expert systems; Blackboards
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 24/02 Arrangements for optimising operational condition
• CPC Class Codes: H04W 52/0209 in terminal devices terminal devices per se H04W88/02

Abstract

Methods, systems and devices for classifying mobile device behaviors of a first mobile device may include the first mobile device monitoring mobile device behaviors to generate a behavior vector, and applying the behavior vector to a first classifier model to obtain a first determination of whether a mobile device behavior is benign or not benign. The first mobile device may also send the behavior vector to a second mobile device, which may receive and apply the behavior vector to a second classifier model to obtain a second determination of whether the mobile device behavior is benign or not benign. The second mobile device may send the second determination to the first mobile device, which may receive the second determination, collate the first determination and the second determination to generate collated results, and determine whether the mobile device behavior is benign or not benign based on the collated results.

Claims

1. A method of classifying mobile device behaviors of a mobile device, comprising:

monitoring mobile device behaviors in a first mobile device to generate a behavior vector;

applying the behavior vector to a first classifier model in the first mobile device to obtain a first determination of whether a mobile device behavior is benign or not benign;

sending the behavior vector to a second mobile device, the second mobile device applying the behavior vector to a second classifier model to obtain a second determination of whether the mobile device behavior is benign or not benign and sending the second determination to the first mobile device;

collating the first determination and the second determination in the first mobile device to generate collated results; and

determining whether the mobile device behavior is benign or not benign based on the collated results.

2. The method of claim 1, wherein the first and second mobile devices are in the same local network.

3. The method of claim 1, wherein sending the behavior vector to the second mobile device comprises broadcasting the behavior vector to all mobile devices on the same local network.

4. The method of claim 1, wherein collating the first determination and the second determination in the first mobile device to generate the collated results comprises generating a weighted linear combination of the first determination and the second determination.

5. The method of claim 1, wherein collating the first determination and the second determination in the first mobile device to generate the collated results comprises:

multiplying the first determination by a first confidence value to generate a first result;

multiplying the second determination by a second confidence value to generate a second result; and

summing the first result with the second result,

wherein the first confidence value is determined by the first classifier model, and

wherein the second confidence value is determined by the second classifier model in the second mobile device and sent to the first mobile device along with the second determination.

6. The method of claim 1, further comprising:

joining a trust network that includes a plurality of trusted mobile devices by performing group formation operations that include establishing direct communication links to each of the plurality of trusted mobile devices via WiFi-Direct technologies, wherein sending the behavior vector to the second mobile device comprises sending the behavior vector to one of the plurality of trusted mobile devices.

7. A mobile device comprising:

a processor;

means for monitoring mobile device behaviors to generate a behavior vector;

means for applying the behavior vector to a first classifier model to obtain a first determination of whether a mobile device behavior is benign or not benign;

means for sending the behavior vector to a second mobile device;

means for receiving a second determination of whether the mobile device behavior is benign or not benign from the second mobile device in response to sending the behavior vector to the second mobile device;

means for collating the first determination and the second determination to generate collated results; and

means for determining whether the mobile device behavior is benign or not benign based on the collated results.

8. The mobile device of claim 7, wherein means for sending the behavior vector to the second mobile device comprises means for sending the behavior vector to a mobile computing device in a local network.

9. The mobile device of claim 7, wherein means for sending the behavior vector to the second mobile device comprises means for broadcasting the behavior vector to all mobile devices in a local network.

10. The mobile device of claim 7, wherein means for collating the first determination and the second determination to generate collated results comprises means for generating a weighted linear combination of the first determination and the second determination.

11. The mobile device of claim 7, wherein means for collating the first determination and the second determination to generate collated results comprises:

means for multiplying the first determination by a first confidence value to generate a first result;

means for multiplying the second determination by a second confidence value to generate a second result; and

means for summing the first result with the second result,

wherein the first confidence value is determined by the first classifier model, and

wherein the second confidence value is determined by a second classifier model in the second mobile device and sent to the mobile device along with the second determination.

12. The mobile device of claim 7, further comprising:

means for joining a trust network that includes a plurality of trusted mobile devices by performing group formation operations that include establishing direct communication links to each of the plurality of trusted mobile devices via WiFi-Direct technologies, and wherein means for sending the behavior vector to the second mobile device comprises means for sending the behavior vector to one of the plurality of trusted mobile devices.

13. A mobile computing device, comprising:

a processor configured with processor-executable instructions to perform operations comprising;

monitoring mobile device behaviors to generate a behavior vector;

applying the behavior vector to a first classifier model to obtain a first determination of whether a mobile device behavior is benign or not benign;

sending the behavior vector to a second mobile device;

receiving a second determination of whether the mobile device behavior is benign or not benign from the second mobile device in response to sending the behavior vector to the second mobile device;

collating the first determination and the second determination to generate collated results; and

determining whether the mobile device behavior is benign or not benign based on the collated results.

14. The mobile computing device of claim 13, wherein the processor is configured with processor-executable instructions to perform operations such that sending the behavior vector to the second mobile device comprises sending the behavior vector to a mobile device in a local network.

15. The mobile computing device of claim 13, wherein the processor is configured with processor-executable instructions to perform operations such that sending the behavior vector to the second mobile device comprises broadcasting the behavior vector to all mobile devices in a local network.

16. The mobile computing device of claim 13, wherein the processor is configured with processor-executable instructions to perform operations such that collating the first determination and the second determination to generate the collated results comprises generating a weighted linear combination of the first determination and the second determination.

17. The mobile computing device of claim 13, wherein the processor is configured with processor-executable instructions to perform operations such that collating the first determination and the second determination to generate the collated results comprises:

multiplying the first determination by a first confidence value to generate a first result;

multiplying the second determination by a second confidence value to generate a second result; and

summing the first result with the second result,

wherein the first confidence value is determined by the first classifier model, and

wherein the second confidence value is determined by a second classifier model in the second mobile device and sent to the mobile computing device along with the second determination.

18. The mobile computing device of claim 13, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

joining a trust network that includes a plurality of trusted mobile devices by performing group formation operations that include establishing direct communication links to each of the plurality of trusted mobile devices via WiFi-Direct technologies, wherein sending the behavior vector to the second mobile device comprises sending the behavior vector to one of the plurality of trusted mobile devices.

19. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a mobile device processor to perform operations comprising:

monitoring mobile device behaviors to generate a behavior vector;

applying the behavior vector to a first classifier model to obtain a first determination of whether a mobile device behavior is benign or not benign;

sending the behavior vector to a second mobile device;

receiving a second determination of whether the mobile device behavior is benign or not benign from the second mobile device in response to sending the behavior vector to the second mobile device;

collating the first determination and the second determination to generate collated results; and

determining whether the mobile device behavior is benign or not benign based on the collated results.

20. The non-transitory computer readable storage medium of claim 19, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations such that sending the behavior vector to the second mobile device comprises sending the behavior vector to a mobile device in a local network.

21. The non-transitory computer readable storage medium of claim 19, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations such that sending the behavior vector to the second mobile device comprises broadcasting the behavior vector to all mobile devices in a local network.

22. The non-transitory computer readable storage medium of claim 19, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations such that collating the first determination and the second determination to generate the collated results comprises generating a weighted linear combination of the first determination and the second determination.

23. The non-transitory computer readable storage medium of claim 19, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations such that collating the first determination and the second determination to generate the collated results comprises:

multiplying the first determination by a first confidence value to generate a first result;

multiplying the second determination by a second confidence value to generate a second result; and

summing the first result with the second result,

wherein the first confidence value is determined by the first classifier model, and

wherein the second confidence value is determined by a second classifier model in the second mobile device and sent to the mobile device processor along with the second determination.

24. The non-transitory computer readable storage medium of claim 19, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

joining a trust network that includes a plurality of trusted mobile devices by performing group formation operations that include establishing direct communication links to each of the plurality of trusted mobile devices via WiFi-Direct technologies, wherein sending the behavior vector to the second mobile device comprises sending the behavior vector to one of the plurality of trusted mobile devices.

25. A system comprising:

a first mobile device; and

a second mobile device,

wherein the first mobile device comprises;

a processor;

means for monitoring mobile device behaviors to generate a behavior vector;

means for applying the behavior vector to a first classifier model to obtain a first determination of whether a mobile device behavior is benign or not benign; and

means for sending the behavior vector to the second mobile device;

wherein the second mobile device comprises;

means for receiving the behavior vector from the first mobile device;

means for applying the behavior vector to a second classifier model to obtain a second determination of whether the mobile device behavior is benign or not benign; and

means for sending the second determination of whether the mobile device behavior is benign or not benign to the first mobile device;

wherein the first mobile device further comprises;

means for collating the first determination and the second determination to generate collated results; and

means for determining whether the mobile device behavior is benign or not benign based on the collated results.

26. The system of claim 25, wherein means for sending the behavior vector to the second mobile device comprises means for sending the behavior vector to a mobile computing device in a local network, and means for sending the second determination of whether the mobile device behavior is benign or not benign to the first mobile device comprises means for sending the second determination of whether the mobile device behavior is benign or not benign to the first mobile device in the local network.

27. The system of claim 25, wherein means for sending the behavior vector to the second mobile device comprises means for broadcasting the behavior vector to all mobile devices in a local network.

28. The system of claim 25, wherein means for collating the first determination and the second determination to generate collated results comprises means for generating a weighted linear combination of the first determination and the second determination.

29. The system of claim 25, wherein:

the first mobile device comprises means for determining a first confidence value associated with the first determination;

the second mobile device comprises means for determining a second confidence value associated with the second determination and means for sending the second confidence value to the first mobile device; and

means for collating the first determination and the second determination to generate collated results comprises;

means for multiplying the first determination by the first confidence value to generate a first result;

means for multiplying the second determination by the second confidence value to generate a second result; and

means for summing the first result with the second result.

30. A system, comprising:

a first mobile device; and

a second mobile device,

wherein the first mobile device comprises;

a first processor configured with processor-executable instructions to perform operations comprising;

monitoring mobile device behaviors to generate a behavior vector;

applying the behavior vector to a first classifier model to obtain a first determination of whether a mobile device behavior is benign or not benign; and

sending the behavior vector to the second mobile device,

wherein the second mobile device comprises;

a second processor configured with processor-executable instructions to perform operations comprising;

receiving the behavior vector from the first mobile device;

applying the behavior vector to a second classifier model to obtain a second determination of whether the mobile device behavior is benign or not benign; and

sending the second determination of whether the mobile device behavior is benign or not benign to the first mobile device, and

wherein the first processor is configured with processor-executable instructions to perform operations further comprising;

collating the first determination and the second determination to generate collated results; and

determining whether the mobile device behavior is benign or not benign based on the collated results.

31. The system of claim 30, wherein the first processor is configured with processor-executable instructions to perform operations such that sending the behavior vector to the second mobile device comprises sending the behavior vector to a mobile device in a local network.

32. The system of claim 30, wherein the first processor is configured with processor-executable instructions to perform operations such that sending the behavior vector to the second mobile device comprises broadcasting the behavior vector to all mobile devices in a local network.

33. The system of claim 30, wherein the first processor is configured with processor-executable instructions to perform operations such that collating the first determination and the second determination to generate the collated results comprises generating a weighted linear combination of the first determination and the second determination.

34. The system of claim 30, wherein:

the first processor is configured with processor-executable instructions to perform operations further comprising determining a first confidence value associated with the first determination;

the second processor is configured with processor-executable instructions to perform operations further comprising determining a second confidence value associated with the second determination sending the second confidence value to the first mobile device; and

the first processor is configured with processor-executable instructions to perform operations such that collating the first determination and the second determination to generate the collated results comprises;

multiplying the first determination by the first confidence value to generate a first result;

multiplying the second determination by the second confidence value to generate a second result; and

summing the first result with the second result.