DISTRIBUTED MONITORING, EVALUATION, AND RESPONSE FOR MULTIPLE DEVICES

• US 20150163121A1
• Filed: 12/06/2013
• Published: 06/11/2015
• Est. Priority Date: 12/06/2013
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Mahaffey, Kevin Patrick, Buck, Brian James, Hering, John Gunther, Wyatt, Timothy Micheal, Gupta, Amit, Abey, Alex Cameron
• Granted Patent: US 9,753,796 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0754 by exceeding limits
• CPC Class Codes: G06F 11/0766 Error or fault reporting or storing
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/3089 Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

Data is collected from a set of devices. The data is associated with the devices, mobile application programs (apps), web applications, users, or combinations of these. A norm is established using the collected data. The norm is compared with data collected from a particular device. If there is a deviation outside of a threshold deviation between the norm and the data collected from the particular device, a response is initiated.

Claims

1. A method comprising:

at a server accessing a database system comprising data collected from a plurality of devices;

at the server, establishing a norm by processing the collected data;

at the server comparing the norm with data collected from a first device of the plurality of devices;

at the server determining that a deviation between the norm and the data collected from the first device is outside of a threshold deviation; and

upon the determination, generating an alert by the server.

2. The method of claim 1 wherein the collected data comprises context information associated with event that occurred on a device.

3. The method of claim 1 wherein the collected data comprises context information associated with a state change that occurred on a device.

4. The method of claim 1 wherein the collected data comprises context information associated with configuration settings on a device.

5. The method of claim 1 wherein the collected data comprises monitored information associated with firmware contents, versions, structure, or permissions on a device.

6. The method of claim 1 wherein the collected data comprises monitored information associated with application behavior on a device.

7. The method of claim 1 wherein the step of generating the alert comprises:

blocking the first device from accessing a service.

8. The method of claim 1 wherein the step of generating the alert comprises:

transmitting to the first device instructions to uninstall an application program on the first device.

9. The method of claim 1 wherein the step of generating an alert comprises:

transmitting a message to an administrator.

10. The method of claim 1 wherein the database system comprises a first database, and a second database,

wherein the first database is associated with an organization, comprises data collected from a first subset of the plurality of devices, and the devices in the first subset are associated with the organization, and

wherein the second database comprises data collected from a second subset of the plurality of device, and the devices in the second subset are not associated with the organization.

11. A method comprising:

at a server, monitoring a plurality of devices;

based on the monitoring, at the server establishing a norm;

at the server determining that activity associated with a first device of the plurality of device is outside the norm; and

upon the determination, altering the monitoring of the first device by the server.

12. The method of claim 11 wherein the step of altering the monitoring of the first device comprises:

increasing the monitoring of the first device.

13. The method of claim 11 wherein the step of altering the monitoring of the first device comprises:

decreasing the monitoring of the first device.

14. The method of claim 11 wherein the norm indicates that a first event occurs during a first context, and the step of determining that activity on the first device is outside the norm comprises:

determining that the first event occurred on the first device during a second context, different from the first context.

15. The method of claim 11 wherein the step of determining that activity on the first device is outside the norm comprises:

receiving from the first device an indication that a shared library has been loaded on the first device from a memory card.

16. The method of claim 11 comprising:

generating a model of characteristics for a specific application program on the plurality of device; and

wherein the step of determining that activity on the first device is outside the norm comprises;

determining that an application program, on the first device and identified as being the same as the specific application program, has a characteristic that is not included in the model of characteristics.

17. The method of claim 11 wherein the step of monitoring the plurality of devices comprises:

monitoring a first subset of the plurality of devices for first events associated with an application program on the plurality of devices; and

monitoring a second subset of the plurality of devices for second events associated with the application program,

wherein the second subset of devices is not monitored for the first events, and the first subset of devices is not monitored for the second events.

18. A method comprising:

at a server, distributing first policies to a plurality of devices;

at a server, receiving, from the plurality of devices, data responsive to the first policies;

at the server establishing a normal pattern of activity using the data;

at the server comparing the normal pattern with a first pattern of activity associated with a first device of the plurality of devices;

at the server determining that the first pattern of activity violates the normal pattern of activity; and

upon the determination, transmitting by the server a second policy to the first device to replace the first policy distributed to the first device.

19. The method of claim 18 wherein the first policy specifies collection of a first level of detail, and the second policy specifies collection of a second level of detail, greater than the first level of detail.

20. The method of claim 18 wherein the first policy specifies sampling data associated with the first device at a first frequency, and the second policy specifies sampling the data at a second frequency, greater than the first frequency.

21. The method of claim 18 wherein the received data does not comprise personally identifiable information (PII).

22. The method of claim 18 wherein a violation of the normal pattern of activity is detected when the normal pattern of activity specifies a first sequence of events, and the first pattern of activity specifies a second sequence of the events, different from the first sequence.