Behavioral Analysis for Securing Peripheral Devices

• US 20150262067A1
• Filed: 03/13/2014
• Published: 09/17/2015
• Est. Priority Date: 03/13/2014
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: SRIDHARA, Vinay, Gupta, Rajarshi
• Granted Patent: US 10,176,428 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0742 in a data processing system embedded in a mobile device, e.g. mobile phones, handheld devices
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/3013 where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems testing or monitoring of control systems or parts thereof G05B23/02
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 20/20 Ensemble learning
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06N 99/00 Subject matter not provided for in other groups of this subclass
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

The various aspects configure a mobile computing device to efficiently identify, classify, model, prevent, and/or correct the conditions and/or behaviors occurring on the mobile computing device that are related to one or more peripheral devices connected to the mobile computing device and that often degrade the performance and/or power utilization levels of the mobile computing device over time. In the various aspects, the mobile computing device may obtain a classifier model that includes, tests, and/or evaluates various conditions, features, behaviors and corrective actions on the mobile computing device that are related to one or more peripheral devices connected to the mobile computing device. The mobile computing device may utilize the classifier model to quickly identify and correct undesirable behaviors occurring on the mobile computing device that are related to the one or more connected peripheral devices.

Claims

1. A method of generating data models in a mobile computing device connected to a peripheral device, comprising:

obtaining a classifier model comprising features related to the peripheral device;

observing behaviors of the features related to the peripheral device;

generating a behavior vector for a configuration of the mobile computing device based on the observed behaviors; and

applying the behavior vector to the classifier model to detect undesirable behavior on the mobile computing device related to the peripheral device.

2. The method of claim 1, wherein undesirable behavior related to the peripheral device comprises at least one of:

undesirable behavior occurring on the mobile computing device and caused by the peripheral device;

undesirable behavior occurring on the peripheral device and caused by the mobile computing device; and

undesirable behavior caused by activities occurring on both of the mobile computing device and the peripheral device.

3. The method of claim 1, wherein obtaining a classifier model comprises:

identifying a capability related to the peripheral device;

determining a feature on the mobile computing device related to the identified capability; and

generating the classifier model based on the determined feature.

4. The method of claim 1, wherein obtaining a classifier model comprises:

observing behaviors on the mobile computing device related to the peripheral device over a period of time;

identifying a behavior related to the peripheral device that is expected to occur based on behaviors observed on the mobile computing device over the period of time;

determining a set of features on the mobile computing device related to the expected behavior; and

generating the classifier model based on the determined set of features related to the expected behavior.

5. The method of claim 1, wherein obtaining a classifier model comprises:

receiving a full classifier model generated on a server from a cloud data set of information provided by a plurality of mobile computing devices;

generating a lean classifier model comprising features relevant to the mobile computing device;

determining a feature on the mobile computing device related to the peripheral device; and

modifying the lean classifier model to include the determined feature related to the peripheral device.

6. The method of claim 1, further comprising receiving from the peripheral device observations of behaviors occurring on the peripheral device,

wherein generating a behavior vector for a configuration of the mobile computing device based on the observed behaviors comprises generating the behavior vector based on at least one of the observed behaviors on the mobile computing device and observations received from the peripheral device.

7. The method of claim 1, further comprising observing behaviors on the mobile computing device related to at least one of communications between the mobile computing device and the peripheral device and inputs received from the peripheral device,

wherein generating a behavior vector for a configuration of the mobile computing device based on the observed behaviors comprises generating the behavior vector based on at least one of the observed behaviors related to communications between the mobile computing device and the peripheral device and the inputs received from the peripheral device.

8. A mobile computing device, comprising:

a memory; and

a processor coupled to the memory and configured with processor-executable instructions to perform operations comprising;

obtaining a classifier model comprising features related to a peripheral device connected to the mobile computing device;

observing behaviors of the features related to the peripheral device;

generating a behavior vector for a configuration of the mobile computing device based on the observed behaviors; and

applying the behavior vector to the classifier model to detect undesirable behavior on the mobile computing device related to the peripheral device.

9. The mobile computing device of claim 8, wherein the processor is configured with processor-executable instructions to perform operations such that undesirable behavior related to the peripheral device comprises at least one of:

undesirable behavior occurring on the mobile computing device and caused by the peripheral device;

undesirable behavior occurring on the peripheral device and caused by the mobile computing device; and

undesirable behavior caused by activities occurring on both of the mobile computing device and the peripheral device.

10. The mobile computing device of claim 8, wherein the processor is configured with processor-executable instructions to perform operations such that obtaining a classifier model comprises:

identifying a capability related to the peripheral device;

determining a feature on the mobile computing device related to the identified capability; and

generating the classifier model based on the determined feature.

11. The mobile computing device of claim 8, wherein the processor is configured with processor-executable instructions to perform operations such that obtaining a classifier model comprises:

observing behaviors on the mobile computing device related to the peripheral device over a period of time;

identifying a behavior related to the peripheral device that is expected to occur based on the behaviors observed on the mobile computing device over the period of time;

determining a set of features on the mobile computing device related to the expected behavior; and

generating the classifier model based on the determined set of features related to the expected behavior.

12. The mobile computing device of claim 8, wherein the processor is configured with processor-executable instructions to perform operations such that obtaining a classifier model comprises:

receiving a full classifier model generated on a server from a cloud data set of information provided by a plurality of mobile computing devices;

generating a lean classifier model comprising features relevant to the mobile computing device;

determining a feature on the mobile computing device related to the peripheral device; and

modifying the lean classifier model to include the determined feature related to the peripheral device.

13. The mobile computing device of claim 8, wherein:

the processor is configured with processor-executable instructions to perform operations further comprising receiving from the peripheral device observations of behaviors occurring on the peripheral device; and

the processor is configured with processor-executable instructions to perform operations such that generating a behavior vector for a configuration of the mobile computing device based on the observed behaviors comprises generating the behavior vector based on at least one of the observed behaviors on the mobile computing device and observations received from the peripheral device.

14. The mobile computing device of claim 8, wherein:

the processor is configured with processor-executable instructions to perform operations further comprising observing behaviors on the mobile computing device related to at least one of communications between the mobile computing device and the peripheral device and inputs received from the peripheral device; and

the processor is configured with processor-executable instructions to perform operations such that generating a behavior vector for a configuration of the mobile computing device based on the observed behaviors comprises generating the behavior vector based on at least one of the observed behaviors related to the communications between the mobile computing device and the peripheral device and the inputs received from the peripheral device.

15. A mobile computing device, comprising:

means for obtaining a classifier model comprising features related to a peripheral device connected to the mobile computing device;

means for observing behaviors of the features related to the peripheral device;

means for generating a behavior vector for a configuration of the mobile computing device based on the observed behaviors; and

means for applying the behavior vector to the classifier model to detect undesirable behavior on the mobile computing device related to the peripheral device.

16. The mobile computing device of claim 15, wherein undesirable behavior related to the peripheral device comprises at least one of:

undesirable behavior occurring on the mobile computing device and caused by the peripheral device;

undesirable behavior occurring on the peripheral device and caused by the mobile computing device; and

undesirable behavior caused by activities occurring on both of the mobile computing device and the peripheral device.

17. The mobile computing device of claim 15, wherein means for obtaining a classifier model comprises:

means for identifying a capability related to the peripheral device;

means for determining a feature on the mobile computing device related to the identified capability; and

means for generating the classifier model based on the determined feature.

18. The mobile computing device of claim 15, wherein means for obtaining a classifier model comprises:

means for observing behaviors on the mobile computing device related to the peripheral device over a period of time;

means for identifying a behavior related to the peripheral device that is expected to occur based on behaviors observed on the mobile computing device over the period of time;

means for determining a set of features on the mobile computing device related to the expected behavior; and

means for generating the classifier model based on the determined set of features related to the expected behavior.

19. The mobile computing device of claim 15, wherein means for obtaining a classifier model comprises:

means for receiving a full classifier model generated on a server from a cloud data set of information provided by a plurality of mobile computing devices;

means for generating a lean classifier model comprising features relevant to the mobile computing device;

means for determining a feature on the mobile computing device related to the peripheral device; and

means for modifying the lean classifier model to include the determined feature related to the peripheral device.

20. The mobile computing device of claim 15, further comprising means for receiving from the peripheral device observations of behaviors occurring on the peripheral device,

wherein means for generating a behavior vector for a configuration of the mobile computing device based on the observed behaviors comprises means for generating the behavior vector based on at least one of the observed behaviors on the mobile computing device and observations received from the peripheral device.

21. The mobile computing device of claim 15, further comprising means for observing behaviors on the mobile computing device related to at least one of communications between the mobile computing device and the peripheral device and inputs received from the peripheral device,

wherein means for generating a behavior vector for a configuration of the mobile computing device based on the observed behaviors comprises means for generating the behavior vector based on at least one of the observed behaviors related to communications between the mobile computing device and the peripheral device and the inputs received from the peripheral device.

22. A non-transitory computer-readable storage medium having stored thereon processor-executable software instructions configured to cause a processor of a mobile computing device to perform operations comprising:

obtaining a classifier model comprising features related to a peripheral device connected to the mobile computing device;

observing behaviors of the features related to the peripheral device;

generating a behavior vector for a configuration of the mobile computing device based on the observed behaviors; and

applying the behavior vector to the classifier model to detect undesirable behavior on the mobile computing device related to the peripheral device.

23. The non-transitory computer-readable storage medium of claim 22, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that undesirable behavior related to the peripheral device comprises at least one of:

undesirable behavior occurring on the mobile computing device and caused by the peripheral device;

undesirable behavior occurring on the peripheral device and caused by the mobile computing device; and

undesirable behavior caused by activities occurring on both of the mobile computing device and the peripheral device.

24. The non-transitory computer-readable storage medium of claim 22, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that obtaining a classifier model comprises:

identifying a capability related to the peripheral device;

determining a feature on the mobile computing device related to the identified capability; and

generating the classifier model based on the determined feature.

25. The non-transitory computer-readable storage medium of claim 22, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that obtaining a classifier model comprises:

observing behaviors on the mobile computing device related to the peripheral device over a period of time;

identifying a behavior related to the peripheral device that is expected to occur based on behaviors observed on the mobile computing device over the period of time;

determining a set of features on the mobile computing device related to the expected behavior; and

generating the classifier model based on the determined set of features related to the expected behavior.

26. The non-transitory computer-readable storage medium of claim 22, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that obtaining a classifier model comprises:

receiving a full classifier model generated on a server from a cloud data set of information provided by a plurality of mobile computing devices;

generating a lean classifier model comprising features relevant to the mobile computing device;

determining a feature on the mobile computing device related to the peripheral device; and

modifying the lean classifier model to include the determined feature related to the peripheral device.

27. The non-transitory computer-readable storage medium of claim 22, wherein:

the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising receiving from the peripheral device observations of behaviors occurring on the peripheral device; and

the stored processor-executable software instructions are configured to cause a processor to perform operations such that generating a behavior vector for a configuration of the mobile computing device based on the observed behaviors comprises generating the behavior vector based on at least one of the observed behaviors on the mobile computing device and the observations received from the peripheral device.

28. The non-transitory computer-readable storage medium of claim 22, wherein:

the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising observing behaviors on the mobile computing device related to at least one of communications between the mobile computing device and the peripheral device and inputs received from the peripheral device; and

the stored processor-executable software instructions are configured to cause a processor to perform operations such that generating a behavior vector for a configuration of the mobile computing device based on the observed behaviors comprises generating the behavior vector based on at least one of the observed behaviors related to the communications between the mobile computing device and the peripheral device and the inputs received from the peripheral device.