Communicating Behavior Information in a Mobile Computing Device

• US 20130304869A1
• Filed: 03/12/2013
• Published: 11/14/2013
• Est. Priority Date: 05/14/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Gupta, Rajarshi, Halambi, Soorgoli Ashok, Sridhara, Vinay, Gathala, Sudha A.
• Granted Patent: US 9,690,635 B2
• Time in Patent Office: Days
• US Class Current: 709/219
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 9/541 via adapters, e.g. between incompatible applications

Abstract

Methods, systems and devices for communicating behavior analysis information using an application programming interface (API) may include receiving data/behavior models from one or more third-party network servers in a client module of a mobile device and communicating the information to a behavior observation and analysis system via a behavior API. The third-party servers may be maintained by one or more partner companies that have domain expertise in a particular area or technology that is relevant for identifying, analyzing, classifying, and/or reacting to mobile device behaviors, but that do not have access to (or knowledge of) the various mobile device sub-systems, interfaces, configurations, modules, processes, drivers, and/or hardware systems required to generate effective data/behavior models suitable for use by the mobile device. The behavior API and/or client modules allow the third-party server to quickly and efficiently access the most relevant and important information on the mobile device.

Claims

1. A method of communicating behavior-analysis information between modules of a mobile device, comprising:

exchanging information regarding behavior features observed in the mobile device between a first module and a second module of the mobile device via an application programming interface, the exchanged information including behavior features used by one of the first module and the second module to determine whether a mobile device behavior is benign or not benign.

2. The method of claim 1, further comprising:

receiving a first list of behavior features to be observed in the first module;

identifying behavior features included in the received first list that are best features for enabling a mobile device processor to conclusively determine whether the mobile device behavior is benign or not benign;

generating a second list of behavior features that includes the best features for enabling the mobile device processor to conclusively determine whether the mobile device behavior is benign or not benign; and

sending the second list of behavior features to the second module via the application programming interface.

3. The method of claim 1, further comprising:

receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

4. The method of claim 1, further comprising:

receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

5. The method of claim 4, further comprising:

generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

6. A mobile device, comprising:

a processor; and

means for exchanging information regarding behavior features observed in the mobile device between a first module and a second module of the mobile device via an application programming interface, the exchanged information including behavior features used by one of the first module and the second module to determine whether a mobile device behavior is benign or not benign.

7. The mobile device of claim 6, further comprising:

means for receiving a first list of behavior features to be observed in the first module;

means for identifying behavior features included in the received first list that are best features for conclusively determining whether the mobile device behavior is benign or not benign;

means for generating a second list of behavior features that includes the best features for conclusively determining whether the mobile device behavior is benign or not benign; and

means for sending the second list of behavior features to the second module via the application programming interface.

8. The mobile device of claim 6, further comprising:

means for receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

9. The mobile device of claim 6, further comprising:

means for receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

10. The mobile device of claim 9, further comprising:

means for generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

11. A mobile device, comprising:

a transceiver;

a memory; and

a processor coupled to the transceiver and the memory, wherein the processor is configured with processor-executable instructions to perform operations comprising;

exchanging information regarding behavior features observed in the mobile device between a first module and a second module of the mobile device via an application programming interface, the exchanged information including behavior features used by one of the first module and the second module to determine whether a mobile device behavior is benign or not benign.

12. The mobile device of claim 11, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving a first list of behavior features to be observed in the first module;

identifying behavior features included in the received first list that are best features for conclusively determining whether the mobile device behavior is benign or not benign;

generating a second list of behavior features that includes the best features for conclusively determining whether the mobile device behavior is benign or not benign; and

sending the second list of behavior features to the second module via the application programming interface.

13. The mobile device of claim 11, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

14. The mobile device of claim 11, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

15. The mobile device of claim 14, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

16. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a mobile device processor to perform operations for communicating behavior-analysis information between modules of a mobile device, the operations comprising:

exchanging information regarding behavior features observed in the mobile device between a first module and a second module of the mobile device via an application programming interface, the exchanged information including behavior features used by one of the first module and the second module to determine whether a mobile device behavior is benign or not benign.

17. The non-transitory computer readable storage medium of claim 16, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

receiving a first list of behavior features to be observed in the first module;

identifying behavior features included in the received first list that are best features for conclusively determining whether the mobile device behavior is benign or not benign;

generating a second list of behavior features that includes the best features for enabling the mobile device processor to conclusively determine whether the mobile device behavior is benign or not benign; and

sending the second list of behavior features to the second module via the application programming interface.

18. The non-transitory computer readable storage medium of claim 16, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

19. The non-transitory computer readable storage medium of claim 16, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

20. The non-transitory computer readable storage medium of claim 19, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

21. A method of communicating behavior-analysis information in a mobile device using an application programming interface, comprising:

receiving via the application programming interface a targeted behavior model that identifies factors and data points most relevant to conclusively determining whether a mobile device behavior is benign or not benign.

22. The method of claim 21, wherein receiving the targeted behavior model comprises receiving an XML file.

23. The method of claim 21, further comprising:

receiving a finite state machine representation that includes a mapping of features to behavior classifications in a first module of the mobile device.

24. The method of claim 21, further comprising:

receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

25. The method of claim 21, further comprising:

receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

26. The method of claim 25, further comprising:

generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

27. The method of claim 25, further comprising:

receiving via the application programming interface an updated behavior model that identifies factors and data points most relevant to conclusively determining whether the mobile device behavior is benign or not benign.

28. A mobile device, comprising:

a processor; and

means for receiving via an application programming interface a targeted behavior model that identifies factors and data points most relevant conclusively determining whether a mobile device behavior is benign or not benign.

29. The mobile device of claim 28, wherein means for receiving the targeted behavior model comprises means for receiving an XML file.

30. The mobile device of claim 28, further comprising:

means for receiving a finite state machine representation that includes a mapping of features to behavior classifications in a first module of the mobile device.

31. The mobile device of claim 28, further comprising:

means for receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

32. The mobile device of claim 28, further comprising:

means for receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

33. The mobile device of claim 32, further comprising:

means for generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

34. The mobile device of claim 32, further comprising:

means for receiving via the application programming interface an updated behavior model that identifies factors and data points most relevant to conclusively determining whether the mobile device behavior is benign or not benign.

35. A mobile device, comprising:

a transceiver;

a memory; and

a processor coupled to the transceiver and the memory, wherein the processor is configured with processor-executable instructions to perform operations comprising;

receiving via an application programming interface a targeted behavior model that identifies factors and data points most relevant to conclusively determining whether a mobile device behavior is benign or not benign.

36. The mobile device of claim 35, wherein the processor is configured with processor-executable instructions to perform operations such that receiving the targeted behavior model comprises receiving an XML file.

37. The mobile device of claim 35, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving a finite state machine representation that includes a mapping of features to behavior classifications in a first module of the mobile device.

38. The mobile device of claim 35, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

39. The mobile device of claim 35, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

40. The mobile device of claim 39, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

41. The mobile device of claim 39, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving via the application programming interface an updated behavior model that identifies factors and data points most relevant to conclusively determining whether the mobile device behavior is benign or not benign.

42. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a mobile device processor to perform operations for communicating behavior-analysis information in a mobile device using an application programming interface, the operations comprising:

receiving via the application programming interface a targeted behavior model that identifies factors and data points most relevant to enabling the mobile device processor to conclusively determine whether a mobile device behavior is benign or not benign.

43. The non-transitory computer readable storage medium of claim 42, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations such that receiving the targeted behavior model comprises receiving an XML file.

44. The non-transitory computer readable storage medium of claim 42, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

receiving a finite state machine representation that includes a mapping of features to behavior classifications in a first module of the mobile device.

45. The non-transitory computer readable storage medium of claim 42, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

46. The non-transitory computer readable storage medium of claim 42, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

47. The non-transitory computer readable storage medium of claim 46, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

48. The non-transitory computer readable storage medium of claim 46, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

receiving via the application programming interface an updated behavior model that identifies factors and data points most relevant to enabling the mobile device processor to conclusively determine whether the mobile device behavior is benign or not benign.

49. A method of communicating behavior-analysis information with a third-party server in a client-cloud communication system using an application programming interface, comprising:

receiving in a processor of a mobile device from the third-party server via the application programming interface a first list of behavior features to be observed;

identifying behavior features included in the received first list that are best features for enabling a mobile device processor to conclusively determine whether a mobile device behavior is benign or not benign;

generating a second list of behavior features that includes the identified best features for enabling the mobile device processor to conclusively determine whether the mobile device behavior is malicious or benign;

sending the second list of behavior features to the third-party server via the application programming interface; and

receiving via the application programming interface a finite state machine representation that includes a mapping of features to behavior classifications suitable for use by the mobile device processor in determining whether the mobile device behavior is benign or not benign.

50. The method of claim 49, wherein receiving the first list of behavior features to be observed comprises receiving an XML file via the application programming interface.

51. The method of claim 49, further comprising:

receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

52. The method of claim 49, further comprising:

receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

53. The method of claim 52, further comprising:

generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

54. A mobile device, comprising:

a processor; and

means for receiving via an application programming interface a first list of behavior features to be observed on the mobile device from a third-party server;

means for identifying behavior features included in the received first list that are best features for enabling the processor to conclusively determine whether a mobile device behavior is benign or not benign;

means for generating a second list of behavior features that includes the identified best features for enabling the processor to conclusively determine whether the mobile device behavior is malicious or benign;

means for sending the second list of behavior features to the third-party server via the application programming interface; and

means for receiving via the application programming interface a finite state machine representation that includes a mapping of features to behavior classifications suitable for use by the processor in determining whether the mobile device behavior is benign or not benign.

55. The mobile device of claim 54, wherein means for receiving via the application programming interface the first list of behavior features to be observed comprises means for receiving an XML file via the application programming interface.

56. The mobile device of claim 54, further comprising:

means for receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

57. The mobile device of claim 54, further comprising:

means for receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

58. The mobile device of claim 57, further comprising:

means for generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

59. A mobile device, comprising:

a transceiver;

a memory; and

a processor coupled to the transceiver and the memory, wherein the processor is configured with processor-executable instructions to perform operations comprising;

receiving from a third-party server via an application programming interface a first list of behavior features to be observed;

identifying behavior features included in the received first list that are best features for conclusively determining whether a mobile device behavior is benign or not benign;

generating a second list of behavior features that includes the identified best features for conclusively determining whether the mobile device behavior is malicious or benign;

sending the second list of behavior features to the third-party server via the application programming interface; and

receiving via the application programming interface a finite state machine representation that includes a mapping of features to behavior classifications suitable for use in determining whether the mobile device behavior is benign or not benign.

60. The mobile device of claim 59, wherein the processor is configured with processor-executable instructions to perform operations such that receiving via the application programming interface the first list of behavior features to be observed comprises receiving an XML file via the application programming interface.

61. The mobile device of claim 59, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

62. The mobile device of claim 59, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

63. The mobile device of claim 62, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

64. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a mobile device processor to perform operations for communicating behavior-analysis information with a third-party server in a client-cloud communication system using an application programming interface, the operations comprising:

receiving from the third-party server via the application programming interface a first list of behavior features to be observed;

identifying behavior features included in the received first list that are best features for conclusively determining whether a mobile device behavior is benign or not benign;

generating a second list of behavior features that includes the identified best features for conclusively determining whether the mobile device behavior is malicious or benign;

sending the second list of behavior features to the third-party server via the application programming interface; and

receiving via the application programming interface a finite state machine representation that includes a mapping of features to behavior classifications suitable for use in determining whether the mobile device behavior is benign or not benign.

65. The non-transitory computer readable storage medium of claim 64, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations such that receiving via the application programming interface the first list of behavior features to be observed comprises receiving an XML file via the application programming interface.

66. The non-transitory computer readable storage medium of claim 64, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device processor to notify a mobile device user, block a process, or terminate the process.

67. The non-transitory computer readable storage medium of claim 64, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

68. The non-transitory computer readable storage medium of claim 67, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

69. A method of communicating behavior-analysis information with a third-party server in a client-cloud communication system using an application programming interface, comprising:

receiving in a processor of a mobile device from the third-party server via the application programming interface a first list of behavior features to be observed;

identifying behavior features included in the received first list that are best features for enabling a mobile device processor to conclusively determine whether a mobile device behavior is benign or not benign;

generating a second list of behavior features that includes the identified best features for enabling the mobile device processor to conclusively determine whether the mobile device behavior is benign or not benign;

sending the second list of behavior features to the third-party server via the application programming interface; and

receiving via the application programming interface a targeted behavior model that identifies factors and data points most relevant to enabling the mobile device processor to conclusively determine whether the mobile device behavior is benign or not benign.

70. The method of claim 69, wherein receiving via the application programming interface the first list of behavior features to be observed comprises receiving an XML file via the application programming interface.

71. The method of claim 69, wherein receiving via the application programming interface the targeted behavior model comprises receiving via the application programming interface a finite state machine representation that includes a mapping of features to behavior classifications.

72. The method of claim 69, further comprising:

receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

73. The method of claim 69, further comprising:

receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

74. The method of claim 73, further comprising:

generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

75. A mobile device, comprising:

a processor; and

means for receiving via an application programming interface a first list of behavior features to be observed on the mobile device from a third-party server;

means for identifying behavior features included in the received first list that are best features for enabling the processor to conclusively determine whether a mobile device behavior is benign or not benign;

means for generating a second list of behavior features that includes the identified best features for enabling the processor to conclusively determine whether the mobile device behavior is benign or not benign;

means for sending the second list of behavior features to the third-party server via the application programming interface; and

means for receiving via the application programming interface a targeted behavior model that identifies factors and data points most relevant to the processor to conclusively determine whether the mobile device behavior is benign or not benign.

76. The mobile device of claim 75, wherein means for receiving via the application programming interface the first list of behavior features to be observed comprises means for receiving an XML file via the application programming interface.

77. The mobile device of claim 75, wherein means for receiving via the application programming interface the targeted behavior model comprises means for receiving via the application programming interface a finite state machine representation that includes a mapping of features to behavior classifications.

78. The mobile device of claim 75, further comprising:

means for receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

79. The mobile device of claim 75, further comprising:

means for receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

80. The mobile device of claim 79, further comprising:

means for generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

81. A mobile device, comprising:

a transceiver;

a memory; and

a processor coupled to the transceiver and the memory, wherein the processor is configured with processor-executable instructions to perform operations comprising;

receiving from a third-party server via an application programming interface a first list of behavior features to be observed;

identifying behavior features included in the received first list that are best features conclusively determining whether a mobile device behavior is benign or not benign;

generating a second list of behavior features that includes the identified best features for conclusively determining whether the mobile device behavior is benign or not benign;

sending the second list of behavior features to the third-party server via the application programming interface; and

receiving via the application programming interface a targeted behavior model that identifies factors and data points most relevant to conclusively determining whether the mobile device behavior is benign or not benign.

82. The mobile device of claim 81, wherein the processor is configured with processor-executable instructions to perform operations such that receiving via the application programming interface the first list of behavior features to be observed comprises receiving an XML file via the application programming interface.

83. The mobile device of claim 81, wherein the processor is configured with processor-executable instructions to perform operations such that receiving via the application programming interface the targeted behavior model comprises receiving via the application programming interface a finite state machine representation that includes a mapping of features to behavior classifications.

84. The mobile device of claim 81, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device to notify a mobile device user, block a process, or terminate the process.

85. The mobile device of claim 81, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

86. The mobile device of claim 85, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.

87. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a mobile device processor to perform operations for communicating behavior-analysis information with a third-party server in a client-cloud communication system using an application programming interface, the operations comprising:

receiving from the third-party server via the application programming interface a first list of behavior features to be observed;

identifying behavior features included in the received first list that are best features for conclusively determining whether a mobile device behavior is benign or not benign;

generating a second list of behavior features that includes the identified best features for conclusively determining whether the mobile device behavior is benign or not benign;

sending the second list of behavior features to the third-party server via the application programming interface; and

receiving via the application programming interface a targeted behavior model that identifies factors and data points most relevant to conclusively determining whether the mobile device behavior is benign or not benign.

88. The non-transitory computer readable storage medium of claim 87, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations such that receiving via the application programming interface the first list of behavior features to be observed comprises receiving an XML file via the application programming interface.

89. The non-transitory computer readable storage medium of claim 87, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations such that receiving via the application programming interface the targeted behavior model comprises receiving via the application programming interface a finite state machine representation that includes a mapping of features to behavior classifications.

90. The non-transitory computer readable storage medium of claim 87, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

receiving via the application programming interface a request for actuation that includes a command suitable for causing the mobile device processor to notify a mobile device user, block a process, or terminate the process.

91. The non-transitory computer readable storage medium of claim 87, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

receiving via the application programming interface a request for a behavior log that identifies one of a granularity level, a specific application, a duration or period of time, a process, and a priority.

92. The non-transitory computer readable storage medium of claim 91, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

generating the behavior log to include information collected based on an analysis of one of the mobile device behavior, the specific application, and the process.