Methods, Devices, and Systems for Communicating Behavioral Analysis Information

• US 20140337862A1
• Filed: 07/24/2014
• Published: 11/13/2014
• Est. Priority Date: 05/14/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Gupta, Rajarshi, Christodorescu, Mihai, Valencia, Andres
• Granted Patent: US 9,609,456 B2
• Time in Patent Office: Days
• US Class Current: 719/313
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: H04M 3/00 Automatic or semi-automatic exchanges
• CPC Class Codes: H04W 4/00 Services specially adapted for wireless communication networks; Facilities therefor

Abstract

Methods, systems and devices for communicating behavior analysis information using an application programming interface (API) may include receiving via the API a request to register the second module to access an operation of a behavioral monitoring system of the mobile computing device, and exchanging authentication information between the first module and the second module to accomplish mutual authentication. Aspects may include receiving via the API a request for version identification information that may be used by the server to determine how to interpret, evaluate, or crowd-source information, and exchanging version identification information between the first module and the second module to cause the second module to send the information to the server. Aspects may further include receiving via the API a provision malware model request including a command causing the first module to send a malware or classifier model to a behavioral monitoring system of the mobile computing device.

Claims

1. A method of communicating behavior-analysis information between modules of a mobile computing device to communicate with a server, comprising:

exchanging information regarding behavior features observed in the mobile computing device between a first module and a second module of the mobile computing device via an application programming interface (API).

2. The method of claim 1, further comprising:

receiving via the API a request to register the second module to access an operation of a behavioral monitoring system of the mobile computing device; and

exchanging authentication information between the first module and the second module to accomplish mutual authentication.

3. The method of claim 1, further comprising:

receiving via the API a request for version identification information that may be used by the server to determine how to interpret, evaluate, or crowd-source information; and

exchanging the version identification information between the first module and the second module to cause the second module to send the version identification information to the server.

4. The method of claim 1, further comprising:

receiving via the API a provision malware model request that includes a command suitable for causing the first module to send a malware or classifier model to a behavioral monitoring system of the mobile computing device.

5. The method of claim 1, further comprising:

receiving a request observation request for the mobile computing device to monitor or observe a specific mobile computing device behavior; and

exchanging the request observation request between the second module and the first module to cause the mobile computing device to monitor or observe the specific mobile computing device behavior.

6. The method of claim 1, further comprising:

receiving via the API a request to receive information regarding an occurrence of a condition or event; and

exchanging version identification information between the first module and the second module to cause the second module to send specific information regarding the occurrence of the condition or event to the server.

7. The method of claim 1, further comprising:

receiving via the API a request for actuation that includes a command suitable for causing the mobile computing device to uninstall an application, block a process, or terminate the process.

8. The method of claim 1, further comprising:

receiving via the API a request for automatic actuation that includes a command suitable for causing the mobile computing device to define a condition or event that will cause the mobile computing device to perform an actuation operation.

9. The method of claim 8, wherein the actuation operation includes one of uninstalling an application, blocking a process, and terminating the process.

10. A mobile computing device, comprising:

a processor configured with processor-executable instructions to perform operations communicating behavior-analysis information between modules of the mobile computing device to communicate with a server, comprising;

exchanging information regarding behavior features observed in the mobile computing device between a first module and a second module of the mobile computing device via an application programming interface (API).

11. The mobile computing device of claim 10, wherein the processor is further configured with processor-executable instructions to perform operations comprising:

receiving via the API a request to register the second module to access an operation of a behavioral monitoring system of the mobile computing device; and

exchanging authentication information between the first module and the second module to accomplish mutual authentication.

12. The mobile computing device of claim 10, wherein the processor is further configured with processor-executable instructions to perform operations comprising:

receiving via the API a request for version identification information that may be used by the server to determine how to interpret, evaluate, or crowd-source information; and

exchanging the version identification information between the first module and the second module to cause the second module to send the version identification information to the server.

13. The mobile computing device of claim 10, wherein the processor is further configured with processor-executable instructions to perform operations comprising:

receiving via the API a provision malware model request that includes a command suitable for causing the first module to send a malware or classifier model to a behavioral monitoring system of the mobile computing device.

14. The mobile computing device of claim 10, wherein the processor is further configured with processor-executable instructions to perform operations comprising:

receiving a request observation request for the mobile computing device to monitor or observe a specific mobile computing device behavior; and

exchanging the request observation request between the second module and the first module to cause the mobile computing device to monitor or observe the specific mobile computing device behavior.

15. The mobile computing device of claim 10, wherein the processor is further configured with processor-executable instructions to perform operations comprising:

receiving via the API a request to receive information regarding an occurrence of a condition or event; and

exchanging version identification information between the first module and the second module to cause the second module to send specific information regarding the occurrence of the condition or event to the server.

16. The mobile computing device of claim 10, wherein the processor is further configured with processor-executable instructions to perform operations comprising:

receiving via the API a request for actuation that includes a command suitable for causing the mobile computing device to uninstall an application, block a process, or terminate the process.

17. The mobile computing device of claim 10, wherein the processor is further configured with processor-executable instructions to perform operations comprising:

receiving via the API a request for automatic actuation that includes a command suitable for causing the mobile computing device to define a condition or event that will cause the mobile computing device to perform an actuation operation.

18. The mobile computing device of claim 17, wherein the actuation operation includes one of uninstalling an application, blocking a process, and terminating the process.

19. A non-transitory processor-readable storage medium having stored thereon processor-executable instructions to cause a processor of a mobile computing device to perform operations comprising:

exchanging information regarding behavior features observed in the mobile computing device between a first module and a second module of the mobile computing device via an application programming interface (API).

20. The non-transitory processor-readable storage medium of claim 19, wherein the processor-executable instructions are further configured to perform operations comprising:

receiving via the API a request to register the second module to access an operation of a behavioral monitoring system of the mobile computing device; and

exchanging authentication information between the first module and the second module to accomplish mutual authentication.