REAL-TIME RECORDING AND MONITORING OF MOBILE APPLICATIONS

• US 20150242623A1
• Filed: 05/01/2014
• Published: 08/27/2015
• Est. Priority Date: 02/26/2014
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: LINDO, Jonathan, LAKAMSANI, Vamsee, KRISHNA, Vikas, PRABHU, Nagi
• Granted Patent: US 9,916,442 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2115 Third party

Abstract

Systems and methods may include monitoring data input to and output from an application on a mobile device. Such systems and methods may include storing meta-data, which describes a behavior of the data input to and output from the application, on the mobile device. Such systems and methods may include determining whether a behavior of the application is anomalous based on the meta-data stored on the mobile device. Such systems and methods may include providing detailed data, which includes the data input to and output from the application, to another device in response to determining that the behavior of the application is anomalous based on the meta-data stored on the mobile device.

Claims

1. A method comprising:

monitoring data input to and output from an application on a mobile device;

storing meta-data, which describes a behavior of the data input to and output from the application, on the mobile device;

determining whether a behavior of the application is anomalous based on the meta-data stored on the mobile device; and

providing detailed data, which includes the data input to and output from the application, to another device in response to determining that the behavior of the application is anomalous based on the meta-data stored on the mobile device.

2. The method of claim 1, wherein determining whether the behavior of the application is anomalous based on the meta-data stored on the mobile device includes:

determining whether the behavior of the application deviates from a baseline level by a predetermined amount or greater; and

determining that the behavior of the application is anomalous in response to determining that the behavior of the application deviates from the baseline level by the predetermined amount or greater.

3. The method of claim 2,

wherein the behavior of the application corresponds to an amount of processor capacity utilized by the application,

wherein the baseline level corresponds to an average amount of processor capacity utilized by a plurality of applications similar to the application, and

wherein the predetermined amount is a deviation of about 30%.

4. The method of claim 1, further comprising:

providing the meta-data to the other device;

receiving feedback data from the other device, the feedback data indicating whether the behavior of the application is anomalous based on the meta-data; and

providing the detailed data to the other device in response to receiving feedback data indicating that the behavior of the application is anomalous based on the meta-data.

5. The method of claim 1, further comprising:

injecting a dynamic real-time security and behavior analysis engine into the application using one of a software development kit and an application wrapping technique,

wherein the dynamic real-time security and behavior analysis engine controls the process of monitoring the data input to and output from the application on the mobile device.

6. The method of claim 1, further comprising:

providing the meta-data to the other device; and

receiving feedback data from the other device, the feedback data indicating a baseline level for the behavior of the application,

wherein determining whether the behavior of the application is anomalous based on the meta-data stored on the mobile device includes;

determining whether the behavior of the application deviates from the baseline level by a predetermined amount or greater, and

determining that the behavior of the application is anomalous in response to determining that the behavior of the application deviates from the baseline level by the predetermined amount or greater.

7. The method of claim 1, further comprising:

receiving feedback data from the other device, the feedback data indicating whether the behavior of the application is anomalous based on the detailed data; and

restricting the application'"'"'s access to a resource in response to receiving feedback data indicating that the behavior of the application is anomalous based on the detailed data.

8. A system comprising:

a monitoring device configured to monitor data input to and output from an application on a mobile device;

a memory of the mobile device configured to store meta-data, which describes a behavior of the data input to and output from the application;

a determining device configured to determine whether a behavior of the application is anomalous based on the meta-data stored on the mobile device; and

an output device configured to provide detailed data, which includes the data input to and output from the application, to another device in response to determining that the behavior of the application is anomalous based on the meta-data stored on the mobile device.

9. The system according to claim 8, wherein the determining device is configured to:

determine whether the behavior of the application deviates from a baseline level by a predetermined amount or greater; and

determine that the behavior of the application is anomalous in response to determining that the behavior of the application deviates from the baseline level by the predetermined amount or greater.

10. The system according to claim 9,

wherein the behavior of the application corresponds to an amount of processor capacity utilized by the application,

wherein the baseline level corresponds to an average amount of processor capacity utilized by a plurality of applications similar to the application, and

wherein the predetermined amount is a deviation of about 30%.

11. The system according to claim 8,

wherein the output device is further configured to provide the meta-data to the other device,

wherein the system further comprises a receiving device configured to receive feedback data from the other device, the feedback data indicating whether the behavior of the application is anomalous based on the meta-data, and

wherein the output device is further configured to provide the detailed data to the other device in response to receiving feedback data indicating that the behavior of the application is anomalous based on the meta-data.

12. The system according to claim 8,

wherein the application is configured to receive a dynamic real-time security and behavior analysis engine injected thereinto via one of a software development kit and an application wrapping technique,

wherein the dynamic real-time security and behavior analysis engine is configured to control the monitoring device, the determining device, and the output device.

13. The system according to claim 8,

wherein the output device is further configured to provide the meta-data to the other device,

wherein the system further comprises a receiving device configured to receive feedback data from the other device, the feedback data indicating a baseline level for the behavior of the application,

wherein the determining device is configured to:

determine whether the behavior of the application deviates from the baseline level by a predetermined amount or greater; and

determine that the behavior of the application is anomalous in response to determining that the behavior of the application deviates from the baseline level by the predetermined amount or greater.

14. The system according to claim 8, further comprising:

a receiving device configured to receive feedback data from the other device, the feedback data indicating whether the behavior of the application is anomalous based on the detailed data; and

an enforcement device configured to restrict the application'"'"'s access to a resource in response to receiving feedback data indicating that the behavior of the application is anomalous based on the detailed data.

15. A computer program product comprising:

a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising;

computer readable program code configured to monitor data input to and output from an application on a mobile device;

computer readable program code configured to store meta-data, which describes a behavior of the data input to and output from the application, on the mobile device;

computer readable program code configured to determine whether a behavior of the application is anomalous based on the meta-data stored on the mobile device; and

computer readable program code configured to provide detailed data, which includes the data input to and output from the application, to another device in response to determining that the behavior of the application is anomalous based on the meta-data stored on the mobile device.

16. The computer program product of claim 15, wherein the computer readable program code configured to determine whether the behavior of the application is anomalous based on the meta-data stored on the mobile device comprises:

computer readable program code configured to determine whether the behavior of the application deviates from a baseline level by a predetermined amount or greater; and

computer readable program code configured to determine that the behavior of the application is anomalous in response to determining that the behavior of the application deviates from the baseline level by the predetermined amount or greater.

17. The computer program product of claim 16,

wherein the behavior of the application corresponds to an amount of processor capacity utilized by the application,

wherein the baseline level corresponds to an average amount of processor capacity utilized by a plurality of applications similar to the application, and

wherein the predetermined amount is a deviation of about 30%.

18. The computer program product of claim 15, further comprising:

computer readable program code configured to provide the meta-data to the other device;

computer readable program code configured to receive feedback data from the other device, the feedback data indicating whether the behavior of the application is anomalous based on the meta-data; and

computer readable program code configured to provide the detailed data to the other device in response to receiving feedback data indicating that the behavior of the application is anomalous based on the meta-data.

19. The computer program product of claim 15, further comprising:

computer readable program code configured to inject a dynamic real-time security and behavior analysis engine into the application using one of a software development kit and an application wrapping technique,

wherein the dynamic real-time security and behavior analysis engine is configured to control the computer readable program code configured to monitor the data input to and output from the application on the mobile device.

20. The computer program product of claim 15, further comprising:

computer readable program code configured to provide the meta-data to the other device,

computer readable program code configured to receive feedback data from the other device, the feedback data indicating a baseline level for the behavior of the application,

wherein the computer readable program code configured to determine whether the behavior of the application is anomalous based on the meta-data stored on the mobile device comprises;

computer readable program code configured to determine whether the behavior of the application deviates from the baseline level by a predetermined amount or greater, and

computer readable program code configured to determine that the behavior of the application is anomalous in response to determining that the behavior of the application deviates from the baseline level by the predetermined amount or greater.