Adaptive Observation of Driver and Hardware Level Behavioral Features on a Mobile Device

• US 20140150100A1
• Filed: 01/23/2014
• Published: 05/29/2014
• Est. Priority Date: 08/15/2012
• Status: Abandoned Application

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: GUPTA, Rajarshi, Sridhara, Vinay, Christodorescu, Mihai
• Application Number:
  US14/161,853
• Publication Number:
  US 20140150100A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06N 5/043 Distributed expert systems; Blackboards
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Methods, devices and systems for detecting suspicious or performance-degrading mobile device behaviors intelligently, dynamically, and/or adaptively determine computing device behaviors that are to be observed, the number of behaviors that are to be observed, and the level of detail or granularity at which the mobile device behaviors are to be observed. The various aspects efficiently identify suspicious or performance-degrading mobile device behaviors without requiring an excessive amount of processing, memory, or energy resources.

Claims

1. A method for observing mobile device behaviors over a period of time to recognize mobile device behaviors inconsistent with normal operation patterns, the method comprising:

determining in a processor of a mobile device a feature that is to be observed in the mobile device in order to identify a suspicious behavior of the mobile device; and

adaptively observing the determined feature by collecting behavior information from a hardware component associated with the determined feature.

2. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the hardware component comprises collecting behavior information from one or more of:

an inertia sensor component;

a battery hardware component;

a browser supporting hardware component;

a camera hardware component;

a subscriber identity module (SIM) hardware component;

a location hardware component;

a microphone hardware component;

a radio interface hardware component;

a speaker hardware component;

a screen hardware component;

a synchronization hardware component;

a storage component;

a universal serial bus hardware component;

a user interaction hardware component;

an inertia sensor driver component;

a battery hardware driver component;

a browser supporting hardware driver component;

a camera hardware driver component;

a SIM hardware driver component;

a location hardware driver component;

a microphone hardware driver component;

a radio interface hardware driver component;

a speaker hardware driver component;

a screen hardware driver component;

a synchronization hardware driver component;

a storage driver component;

a universal serial bus hardware driver component;

hardware component connected through a universal serial bus; and

a user interaction hardware driver component.

3. The method of claim 2, wherein collecting behavior information from the hardware component associated with the feature comprises collecting information from a log of application programming interface (API) calls that temporarily or permanently stores API call information for access or use of the hardware component by software applications of the mobile device.

4. The method of claim 1, wherein determining the feature that is to be observed in the mobile device to identify the suspicious behavior of the mobile device comprises:

applying machine learning techniques to generate a first family of classifier models that describe a cloud corpus of behavior vectors;

determining which factors in the first family of classifier models have a highest probably of enabling a mobile device to conclusively determine whether a mobile device behavior is malicious or benign;

generating a second family of classifier models that identify significantly fewer factors and data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is malicious or benign based on the determined factors;

generating a mobile device classifier model based on the second family of classifier models; and

using the generated classifier model to identify the feature that is to be observed.

5. The method of claim 4, further comprising using the generated classifier model to analyze the collected behavior information.

6. A mobile computing device, comprising:

a processor configured with processor-executable instructions to perform operations comprising;

determining a feature that is to be observed to identify a suspicious behavior of the mobile device; and

adaptively observing the determined feature by collecting behavior information from a hardware component associated with the determined feature.

7. The mobile computing device of claim 6, wherein the processor is configured with processor-executable instructions to perform operations such that adaptively observing the determined feature by collecting behavior information from the hardware component comprises collecting behavior information from one or more of:

an inertia sensor component;

a battery hardware component;

a browser supporting hardware component;

a camera hardware component;

a subscriber identity module (SIM) hardware component;

a location hardware component;

a microphone hardware component;

a radio interface hardware component;

a speaker hardware component;

a screen hardware component;

a synchronization hardware component;

a storage component;

a universal serial bus hardware component;

a user interaction hardware component;

an inertia sensor driver component;

a battery hardware driver component;

a browser supporting hardware driver component;

a camera hardware driver component;

a SIM hardware driver component;

a location hardware driver component;

a microphone hardware driver component;

a radio interface hardware driver component;

a speaker hardware driver component;

a screen hardware driver component;

a synchronization hardware driver component;

a storage driver component;

a universal serial bus hardware driver component; and

a user interaction hardware driver component.

8. The mobile computing device of claim 7, wherein the processor is configured with processor-executable instructions to perform operations such that collecting behavior information from the hardware component associated with the feature comprises collecting information from a log of application programming interface (API) calls that stores API call information for access or use of the hardware component by software applications of the mobile device.

9. The mobile computing device of claim 6, wherein the processor is configured with processor-executable instructions to perform operations such that determining the feature that is to be observed in the mobile device to identify the suspicious behavior of the mobile device comprises:

applying machine learning techniques to generate a first family of classifier models that describe a cloud corpus of behavior vectors;

determining which factors in the first family of classifier models have a highest probably of enabling a mobile device to conclusively determine whether a mobile device behavior is malicious or benign;

generating a second family of classifier models that identify significantly fewer factors and data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is malicious or benign based on the determined factors;

generating a mobile device classifier model based on the second family of classifier models; and

using the generated classifier model to identify the feature that is to be observed.

10. The mobile computing device of claim 9, wherein the processor is configured with processor-executable instructions to perform operations further comprising using the generated classifier model to analyze the collected behavior information.

11. A mobile computing device, comprising:

means for determining a feature that is to be observed to identify a suspicious behavior of the mobile device; and

means for adaptively observing the determined feature by collecting behavior information from a hardware component associated with the determined feature.

12. The mobile computing device of claim 11, wherein means for adaptively observing the determined feature by collecting behavior information from the hardware component comprises means for collecting behavior information from one or more of:

an inertia sensor component;

a battery hardware component;

a browser supporting hardware component;

a camera hardware component;

a subscriber identity module (SIM) hardware component;

a location hardware component;

a microphone hardware component;

a radio interface hardware component;

a speaker hardware component;

a screen hardware component;

a synchronization hardware component;

a storage component;

a universal serial bus hardware component;

a user interaction hardware component;

an inertia sensor driver component;

a battery hardware driver component;

a browser supporting hardware driver component;

a camera hardware driver component;

a single or dual SIM hardware driver component;

a location hardware driver component;

a microphone hardware driver component;

a radio interface hardware driver component;

a speaker hardware driver component;

a screen hardware driver component;

a synchronization hardware driver component;

a storage driver component;

a universal serial bus hardware driver component; and

a user interaction hardware driver component.

13. The mobile computing device of claim 12, wherein means for collecting behavior information from the hardware component associated with the feature comprises means for collecting information from a log of application programming interface (API) calls that stores API call information for access or use of the hardware component by software applications of the mobile device.

14. The mobile computing device of claim 11, wherein means for determining the feature that is to be observed in the mobile device to identify the suspicious behavior of the mobile device comprises:

means for applying machine learning techniques to generate a first family of classifier models that describe a cloud corpus of behavior vectors;

means for determining which factors in the first family of classifier models have a highest probably of enabling a mobile device to conclusively determine whether a mobile device behavior is malicious or benign;

means for generating a second family of classifier models that identify significantly fewer factors and data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is malicious or benign based on the determined factors;

means for generating a mobile device classifier model based on the second family of classifier models; and

means for using the generated classifier model to identify the feature that is to be observed.

15. The mobile computing device of claim 14, further comprising means for using the generated classifier model to analyze the collected behavior information.

16. A non-transitory processor readable storage medium having stored thereon processor-executable software instructions configured to cause a mobile device processor to perform operations for observing mobile device behaviors over a period of time to recognize mobile device behaviors inconsistent with normal operation patterns, the operations comprising:

determining a feature that is to be observed to identify a suspicious behavior of the mobile device; and

adaptively observing the determined feature by collecting behavior information from a hardware component associated with the determined feature.

17. The non-transitory processor readable storage medium of claim 16, wherein adaptively observing the determined feature by collecting behavior information from the hardware component comprises collecting behavior information from one or more of:

an inertia sensor component;

a battery hardware component;

a browser supporting hardware component;

a camera hardware component;

a single or dual subscriber identity module (SIM) hardware component;

a location hardware component;

a microphone hardware component;

a radio interface hardware component;

a speaker hardware component;

a screen hardware component;

a synchronization hardware component;

a storage component;

a universal serial bus hardware component;

a user interaction hardware component;

an inertia sensor driver component;

a battery hardware driver component;

a browser supporting hardware driver component;

a camera hardware driver component;

a single or dual SIM hardware driver component;

a location hardware driver component;

a microphone hardware driver component;

a radio interface hardware driver component;

a speaker hardware driver component;

a screen hardware driver component;

a synchronization hardware driver component;

a storage driver component;

a universal serial bus hardware driver component; and

a user interaction hardware driver component.

18. The non-transitory processor readable storage medium of claim 17, wherein collecting behavior information from the hardware component associated with the feature comprises collecting information from a log of application programming interface (API) calls that stores API call information for access or use of the hardware component by software applications of the mobile device.

19. The non-transitory processor readable storage medium of claim 18, wherein determining the feature that is to be observed in the mobile device to identify the suspicious behavior of the mobile device comprises:

applying machine learning techniques to generate a first family of classifier models that describe a cloud corpus of behavior vectors;

determining which factors in the first family of classifier models have a highest probably of enabling a mobile device to conclusively determine whether a mobile device behavior is malicious or benign;

generating a second family of classifier models that identify significantly fewer factors and data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is malicious or benign based on the determined factors;

generating a mobile device classifier model based on the second family of classifier models; and

using the generated classifier model to identify the feature that is to be observed.

20. The non-transitory processor readable storage medium of claim 19, further comprising using the generated classifier model to analyze the collected behavior information.