Efficient On-Device Binary Analysis for Auto-Generated Behavioral Models

• US 20150356451A1
• Filed: 06/04/2014
• Published: 12/10/2015
• Est. Priority Date: 06/04/2014
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: GUPTA, Rajarshi, Sridhara, Vinay, Patne, Satyajit Prabhakar, Christodorescu, Mihai
• Granted Patent: US 9,721,212 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06N 20/00 Machine learning

Abstract

Various aspects provide methods implemented by at least one processor executing on a mobile communication device to efficiently identify, classify, model, prevent, and/or correct the non-benign (e.g., performance degrading) conditions and/or behaviors that are related to an application operating on the device. Specifically, in various aspects, the mobile computing device may derive or extract application-specific features by performing a binary analysis of an application and may determine the application'"'"'s category (e.g., a “games,” “entertainment,” or “news” category) based on the application-specific features. The mobile computing device may also obtain a classifier model associated with the application'"'"'s category that includes various conditions, features, behaviors and corrective actions that may be used to quickly identify and correct non-benign behaviors (e.g., undesirable, malicious, and/or performance-degrading behaviors) occurring on the mobile computing device that are related to the application.

Claims

1. A method of generating data models in a mobile computing device in response to deriving a set of features specific to an application based on a lightweight binary analysis of the application, comprising:

categorizing the application based on the set of application-specific features; and

obtaining a classifier model based on a category of the application.

2. The method of claim 1, wherein the set of application-specific features is generated by:

extracting a set of features related to the application based on the lightweight binary analysis of the application;

comparing the extracted set of features with a list of generic features; and

removing any feature in the set of extracted features that matches a feature in the list of generic features to produce the set of application-specific features.

3. The method of claim 1, wherein categorizing the application based on the set of application-specific features comprises:

classifying behaviors of the application with a generic classifier model;

determining whether there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model based on the classified behaviors;

deriving a set of features specific to the application based on a lightweight binary analysis of the application performed in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model; and

categorizing the application based on the set of application-specific features derived from the lightweight binary analysis of the application performed in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model.

4. The method of claim 1, wherein obtaining a classifier model based on the category of the application comprises:

comparing the category of the application with a list of categories associated with previously generated classifier models;

determining whether the category of the application matches a category included in the list of categories;

obtaining a previously generated classifier model associated with a matching category included in the list of categories in response to determining that the category of the application matches the matching category; and

obtaining a new classifier model based on the set of application-specific features in response to determining that the category of the application does not match a category in the list of categories.

5. The method of claim 1, further comprising:

observing behaviors of the set of application-specific features;

generating a behavior vector for the application based on the observed behaviors; and

applying the behavior vector to the classifier model to detect non-benign behavior on the mobile computing device related to the application.

6. The method of claim 5, further comprising:

identifying features related to the application that are occurring on the mobile computing device based on the observed behaviors;

determining whether there is a non-trivial difference between the features related to the application that are occurring on the mobile computing device and the set of application-specific features included in the classifier model; and

obtaining a different classifier model based on the features related to the application that are occurring on the mobile computing device in response to determining that there is a non-trivial difference between the features related to the application that are occurring on the mobile computing device and the set of application-specific features included in the classifier model.

7. The method of claim 5, wherein:

applying the behavior vector to the classifier model to detect non-benign behavior on the mobile computing device related to the application comprises applying the behavior vector to the classifier model to generate a behavior classification determination and a confidence value associated with the behavior classification determination; and

the method further comprises;

determining whether the confidence value associated with the behavior classification determination is less than a low-confidence threshold value;

determining whether there is a consistent history of behavior classification determinations with low-confidence values associated with the classifier model in response to determining that the confidence value associated with the behavior classification determination is less than the low-confidence threshold value;

obtaining a refined classifier model associated with the category of the application in response to determining that there is not a consistent history of behavior classification determinations with low-confidence values associated with the classifier model; and

performing an analysis of the set of application-specific features to determine a new category for the application and obtaining another classifier model based on the new category of the application in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the classifier model.

8. A mobile computing device, comprising:

a memory; and

a processor coupled to the memory and configured with processor-executable instructions to perform operations comprising;

categorizing an application based on a set of application-specific features; and

obtaining a classifier model based on a category of the application.

9. The mobile computing device of claim 8, wherein the processor is configured with processor-executable instructions to perform operations such that the set of application-specific features is generated by:

extracting a set of features related to the application based on a lightweight binary analysis of the application;

comparing the set of extracted features with a list of generic features; and

removing any feature in the set of extracted features that matches a feature in the list of generic features to produce the set of application-specific features.

10. The mobile computing device of claim 8, wherein the processor is configured with processor-executable instructions to perform operations such that categorizing the application based on a set of application-specific features comprises:

classifying behaviors of the application with a generic classifier model;

determining whether there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model based on the classified behaviors;

deriving a set of features specific to the application based on a lightweight binary analysis of the application performed in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model; and

categorizing the application based on the set of application-specific features derived from the lightweight binary analysis of the application performed in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model.

11. The mobile computing device of claim 8, wherein the processor is configured with processor-executable instructions to perform operations such that obtaining a classifier model based on the category of the application comprises:

comparing the category of the application with a list of categories associated with previously generated classifier models;

determining whether the category of the application matches a category included in the list of categories;

obtaining a previously generated classifier model associated with a matching category included in the list of categories in response to determining that the category of the application matches the matching category; and

obtaining a new classifier model based on the set of application-specific features in response to determining that the category of the application does not match a category in the list of categories.

12. The mobile computing device of claim 8, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

observing behaviors of the set of application-specific features;

generating a behavior vector for the application based on the observed behaviors; and

applying the behavior vector to the classifier model to detect non-benign behavior on the mobile computing device related to the application.

13. The mobile computing device of claim 12, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

identifying features related to the application that are occurring on the mobile computing device based on the observed behaviors;

determining whether there is a non-trivial difference between the features related to the application that are occurring on the mobile computing device and the set of application-specific features included in the classifier model; and

obtaining a different classifier model based on the features related to the application that are occurring on the mobile computing device in response to determining that there is a non-trivial difference between the features related to the application that are occurring on the mobile computing device and the set of application-specific features included in the classifier model.

14. The mobile computing device of claim 12, wherein:

the processor is configured with processor-executable instructions to perform operations such that applying the behavior vector to the classifier model to detect non-benign behavior on the mobile computing device related to the application comprises applying the behavior vector to the classifier model to generate a behavior classification determination and a confidence value associated with the behavior classification determination; and

the processor is configured with processor-executable instructions to perform operations further comprising;

determining whether the confidence value associated with the behavior classification determination is less than a low-confidence threshold value;

determining whether there is a consistent history of behavior classification determinations with low-confidence values associated with the classifier model in response to determining that the confidence value associated with the behavior classification determination is less than the low-confidence threshold value;

obtaining a refined classifier model associated with the category of the application in response to determining that there is not a consistent history of behavior classification determinations with low-confidence values associated with the classifier model; and

performing an analysis of the set of application-specific features to determine a new category for the application and obtaining another classifier model based on the new category of the application in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the classifier model.

15. A non-transitory computer-readable storage medium having stored thereon processor-executable software instructions configured to cause a processor of a mobile computing device to perform operations comprising:

categorizing an application based on a set of application-specific features; and

obtaining a classifier model based on a category of the application.

16. The non-transitory computer-readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that the set of application-specific features is generated by:

extracting a set of features related to the application based on a lightweight binary analysis of the application;

comparing the set of extracted features with a list of generic features; and

removing any feature in the set of extracted features that matches a feature in the list of generic features to produce the set of application-specific features.

17. The non-transitory computer-readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that categorizing the application based on a set of application-specific features comprises:

classifying behaviors of the application with a generic classifier model;

determining whether there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model based on the classified behaviors;

deriving a set of features specific to the application based on a lightweight binary analysis of the application performed in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model; and

categorizing the application based on the set of application-specific features derived from the lightweight binary analysis of the application performed in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model.

18. The non-transitory computer-readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that obtaining a classifier model based on the category of the application comprises:

comparing the category of the application with a list of categories associated with previously generated classifier models;

determining whether the category of the application matches a category included in the list of categories;

obtaining a previously generated classifier model associated with a matching category included in the list of categories in response to determining that the category of the application matches the matching category; and

obtaining a new classifier model based on the set of application-specific features in response to determining that the category of the application does not match a category in the list of categories.

19. The non-transitory computer-readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

observing behaviors of the set of application-specific features;

generating a behavior vector for the application based on the observed behaviors;

applying the behavior vector to the classifier model to detect non-benign behavior on the mobile computing device related to the application;

identifying features related to the application that are occurring on the mobile computing device based on the observed behaviors;

determining whether there is a non-trivial difference between the features related to the application that are occurring on the mobile computing device and the set of application-specific features included in the classifier model; and

obtaining a different classifier model based on the features related to the application that are occurring on the mobile computing device in response to determining that there is a non-trivial difference between the features related to the application that are occurring on the mobile computing device and the set of application-specific features included in the classifier model.

20. The non-transitory computer-readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

observing behaviors of the set of application-specific features;

generating a behavior vector for the application based on the observed behaviors;

applying the behavior vector to the classifier model to generate a behavior classification determination and a confidence value associated with the behavior classification determination;

determining whether the confidence value associated with the behavior classification determination is less than a low-confidence threshold value;

determining whether there is a consistent history of behavior classification determinations with low-confidence values associated with the classifier model in response to determining that the confidence value associated with the behavior classification determination is less than the low-confidence threshold value;

obtaining a refined classifier model associated with the category of the application in response to determining that there is not a consistent history of behavior classification determinations with low-confidence values associated with the classifier model;

performing an analysis of the set of application-specific features to determine a new category for the application and obtaining another classifier model based on the new category of the application in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the classifier model.