Adaptive Observation of Behavioral Features on a Mobile Device

• US 20140317734A1
• Filed: 06/30/2014
• Published: 10/23/2014
• Est. Priority Date: 08/15/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: SRIDHARA, Vinay, GUPTA, Rajarshi, VALENCIA, Andres, SALAJEGHEH, Mastooreh, CHRISTODORESECU, Mihai
• Granted Patent: US 9,330,257 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS

Abstract

Methods, devices and systems for detecting suspicious or performance-degrading mobile device behaviors intelligently, dynamically, and/or adaptively determine computing device behaviors that are to be observed, the number of behaviors that are to be observed, and the level of detail or granularity at which the mobile device behaviors are to be observed. The various aspects efficiently identify suspicious or performance-degrading mobile device behaviors without requiring an excessive amount of processing, memory, or energy resources.

Claims

1. A method for observing mobile device behaviors over a period of time to recognize mobile device behaviors inconsistent with normal operation patterns, the method comprising:

determining in a processor of a mobile device a feature that is to be observed in the mobile device in order to identify a suspicious behavior of the mobile device; and

adaptively observing the determined feature by collecting behavior information from an instrumented component associated with the determined feature.

2. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises one of:

monitoring the instrumented component to detect access or use of call history information without prior user interaction;

monitoring the instrumented component to detect access and use of a proximity sensor;

monitoring access, use, or communication of voicemail information; and

monitoring the instrumented component to identify applications that move to a foreground of an electronic display of the mobile device.

3. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises monitoring universal serial bus (USB) communications.

4. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises monitoring browser-based video, audio, file upload, or camera operations.

5. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises monitoring battery usage levels or patterns.

6. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises one of:

monitoring a software application'"'"'s communication of information after reading a shared data file; and

monitoring a software application'"'"'s communication of information after reading a memory card.

7. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises one of:

monitoring opening or closing of a browser software application; and

monitoring writing or deleting browser information.

8. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises monitoring adding or removing of contacts to a contacts list of the mobile device.

9. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises monitoring the instrumented component to detect a deletion of text or a multimedia message.

10. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises monitoring an access or use of a motion coprocessor.

11. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises monitoring a software application'"'"'s interactions with a power management system.

12. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises monitoring changes in a power state of an electronic display of the mobile device.

13. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises monitoring one or more of usage patterns of a processor, usage patterns of memory, usage patterns of a battery, usage patterns of a sensor, communication patterns, and file access patterns.

14. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises one of

monitoring a pairing with a Bluetooth device;

monitoring near field communication (NFC) multipurpose Internet mail extension (MIME) type objects or communications;

communication via peer-to-peer near NFC links; and

monitoring a sending of an NFC intent.

15. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises one of:

monitoring an installation of a widget in the mobile device;

monitoring an installation of a shortcut in the mobile device;

monitoring communications with a Linux device or virtual file.

16. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises monitoring applications watching for or receiving a boot complete event.

17. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises monitoring the instrumented component to detect display of an invisible widget.

18. The method of claim 1, wherein adaptively observing the determined feature by collecting behavior information from the instrumented component comprises monitoring for applications coming into a foreground in combination with displaying a graphical user interface selected from a keyboard, a keypad and a signature block.

19. A mobile computing device, comprising:

a processor configured with processor-executable instructions to perform operations comprising;

determining a feature that is to be observed in the mobile computing device in order to identify a suspicious behavior of the mobile device; and

adaptively observing the determined feature by collecting behavior information from an instrumented component associated with the determined feature.

20. A non-transitory processor-readable storage medium having stored thereon processor-executable instructions configured to cause a processor of a mobile computing device to perform operations comprising:

determining a feature that is to be observed in the mobile computing device in order to identify a suspicious behavior of the mobile device; and

adaptively observing the determined feature by collecting behavior information from an instrumented component associated with the determined feature.