Methods and Systems for Detecting Fake User Interactions with a Mobile Device for Improved Malware Protection

• US 20160232352A1
• Filed: 02/06/2015
• Published: 08/11/2016
• Est. Priority Date: 02/06/2015
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Chen, Yin, Yoon, Man Ki, Sridhara, Vinay
• Granted Patent: US 9,875,357 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha

Abstract

A computing device processor may be configured with processor-executable instructions to implement methods of detecting and responding to fake user interaction (UI) events. The processor may determine whether a user interaction event is a fake user interaction event by analyzing raw data generated by one or more hardware drivers in conjunction with user interaction event information generated or received by the high-level operating system. In addition, the processor may be configured with processor-executable instructions to implement methods of using behavioral analysis and machine learning techniques to identify, prevent, correct, or otherwise respond to malicious or performance-degrading behaviors of the computing device based on whether a detected user interaction event is an authentic or fake user interaction event.

Claims

1. A method of analyzing an activity of a software application operating on a computing device, comprising:

comparing raw data received from a user input device of the computing device to user interaction event information received in the computing device to generate analysis results; and

using the analysis results to determine whether a user interaction event correlates with a user of the computing device.

2. The method of claim 1, wherein:

the raw data received from the user input device comprises raw data received from a device driver; and

the user interaction event information received in the computing device comprises interaction information received from a high level operating system of the computing device.

3. The method of claim 2, further comprising classifying the activity of the software application as non-benign in response to determining that the user interaction event does not correlate with a user of the computing device.

4. The method of claim 2, further comprising:

generating a behavior vector that characterizes the activity of the software application;

applying the behavior vector to a classifier model that includes a decision node that evaluates whether there is a user interaction event that corresponds to the activity in response to determining that the user interaction event does not correlate with a user of the computing device; and

using a result of applying the behavior vector to the classifier model to determine whether the activity of the software application is non-benign.

5. The method of claim 2, further comprising:

generating a behavior vector that characterizes the activity of the software application;

selecting a classifier model that does not include a decision node that tests whether there is a user interaction event that corresponds to the activity in response to determining that the user interaction event does not correlate with a user of the computing device;

applying the behavior vector to the selected classifier model to generate additional analysis results; and

using the additional analysis results to determine whether the activity of the software application is non-benign.

6. The method of claim 1, further comprising:

selecting a family of robust classifier models in response to determining that the user interaction event does not correlate with a user of the computing device; and

applying a plurality of behavior vectors to the selected family of robust classifier models to determine whether the activity of the software application is non-benign.

7. The method of claim 1, further comprising comparing raw data received from a first sensor of the computing device to raw data received from a second sensor of the computing device to determine whether the raw data received from the first sensor is consistent with the raw data received from the second sensor,

wherein comparing the raw data received from the user input device of the computing device to the user interaction event information received in the computing device to generate the analysis results is preformed in response to determining that the raw data received from the first sensor is consistent with the raw data received from the second sensor.

8. The method of claim 7, wherein comparing raw data received from the first sensor to the raw data received from the second sensor comprises comparing results of applying behavior vectors to classifier models.

9. The method of claim 1, wherein:

the raw data received from the user input device comprises raw data received from a user input sensor;

the user interaction event information received in the computing device comprises data received from a device driver for the user input sensor; and

using the analysis results to determine whether the user interaction event correlates with a user of the computing device comprises determining that the user interaction event does not correlate with a user of the computing device in response to the raw data received from the user input sensor does not correlate to the data received from the device driver for the user input sensor.

10. The method of claim 9, wherein:

the user input sensor comprises a touch screen; and

the device driver comprises a touch screen device driver.

11. The method of claim 9, further comprising:

classifying the activity of the software application as non-benign in response to determining that the user interaction event does not correlate with a user of the computing device.

12. The method of claim 9, further comprising:

generating a behavior vector that characterizes the activity of the software application;

applying the behavior vector to a classifier model that does not include a decision node that evaluates conditions related to user interactions with the computing device in response to determining that the user interaction event does not correlate with a user of the computing device; and

using a result of applying the behavior vector to the classifier model to determine whether the activity of the software application is non-benign.

13. A computing device, comprising:

means for comparing raw data received from a user input device to user interaction event information to generate analysis results; and

means for using the analysis results to determine whether a user interaction (UI) event correlates with a user of the computing device.

14. The computing device of claim 13, wherein means for comparing raw data received from the user input device to the user interaction event information to generate the analysis results comprises means for comparing raw data received from a device driver to interaction information received from a high level operating system.

15. The computing device of claim 14, further comprising means for classifying an activity of a software application as non-benign in response to determining that the user interaction event does not correlate with a user of the computing device.

16. The computing device of claim 14, further comprising:

means for generating a behavior vector that characterizes an activity of a software application;

means for applying the behavior vector to a classifier model that includes a decision node that evaluates whether there is a user interaction event that corresponds to the activity in response to determining that the user interaction event does not correlate with a user of the computing device; and

means for using a result of applying the behavior vector to the classifier model to determine whether the activity of the software application is non-benign.

17. The computing device of claim 14, further comprising:

means for generating a behavior vector that characterizes an activity of a software application;

means for selecting a classifier model that does not include a decision node that tests whether there is a user interaction event that corresponds to the activity in response to determining that the user interaction event does not correlate with a user of the computing device;

means for applying the behavior vector to the selected classifier model to generate additional analysis results; and

means for using the additional analysis results to determine whether the activity of the software application is non-benign.

18. The computing device of claim 13, further comprising:

means for selecting a family of robust classifier models in response to determining that the user interaction event does not correlate with a user of the computing device; and

means for applying a plurality of behavior vectors to the selected family of robust classifier models to determine whether an activity of a software application is non-benign.

19. A computing device, comprising:

a processor configured with processor-executable instructions to perform operations comprising;

comparing raw data received from a user input device to user interaction event information to generate analysis results; and

using the analysis results to determine whether a user interaction (UI) event correlates with a user of the computing device.

20. The computing device of claim 19, wherein the processor is configured with processor-executable instructions to perform operations such that comparing raw data received from the user input device to the user interaction event information to generate the analysis results comprises comparing raw data received from a device driver to interaction information received from a high level operating system.

21. The computing device of claim 20, wherein the processor is configured with processor-executable instructions to perform operations further comprising classifying an activity of a software application as non-benign in response to determining that the user interaction event does not correlate with a user of the computing device.

22. The computing device of claim 20, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

generating a behavior vector that characterizes an activity of a software application;

applying the behavior vector to a classifier model that includes a decision node that evaluates whether there is a user interaction event that corresponds to the activity in response to determining that the user interaction event does not correlate with a user of the computing device; and

using a result of applying the behavior vector to the classifier model to determine whether the activity of the software application is non-benign.

23. The computing device of claim 20, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

generating a behavior vector that characterizes an activity of a software application;

selecting a classifier model that does not include a decision node that tests whether there is a user interaction event that corresponds to the activity in response to determining that the user interaction event does not correlate with a user of the computing device;

applying the behavior vector to the selected classifier model to generate additional analysis results; and

using the additional analysis results to determine whether the activity of the software application is non-benign.

24. The computing device of claim 19, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

selecting a family of robust classifier models in response to determining that the user interaction event does not correlate with a user of the computing device; and

applying a plurality of behavior vectors to the selected family of robust classifier models to determine whether an activity of a software application is non-benign.

25. A non-transitory computer-readable storage medium having stored thereon processor-executable instructions configured to cause a processor of a computing device to perform operations comprising:

comparing raw data received from a user input device to user interaction event information to generate analysis results; and

using the analysis results to determine whether a user interaction (UI) event correlates with a user of the computing device.

26. The non-transitory computer-readable storage medium of claim 25, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that comparing raw data received from the user input device to the user interaction event information comprises comparing raw data received from a device driver to interaction information received from a high level operating system.

27. The non-transitory computer-readable storage medium of claim 26, wherein the stored processor-executable instructions are configured to cause a processor to perform operations further comprising classifying an activity of a software application as non-benign in response to determining that the user interaction event does not correlate with a user of the computing device.

28. The non-transitory computer-readable storage medium of claim 27, wherein the stored processor-executable instructions are configured to cause a processor to perform operations further comprising:

generating a behavior vector that characterizes the activity of the software application;

applying the behavior vector to a classifier model that includes a decision node that evaluates whether there is a user interaction event that corresponds to the activity in response to determining that the user interaction event does not correlate with a user of the computing device; and

using a result of applying the behavior vector to the classifier model to determine whether the activity of the software application is non-benign.

29. The non-transitory computer-readable storage medium of claim 27, wherein the stored processor-executable instructions are configured to cause a processor to perform operations further comprising:

generating a behavior vector that characterizes the activity of the software application;

selecting a classifier model that does not include a decision node that tests whether there is a user interaction event that corresponds to the activity in response to determining that the user interaction event does not correlate with a user of the computing device;

applying the behavior vector to the selected classifier model to generate additional analysis results; and

using the additional analysis results to determine whether the activity of the software application is non-benign.

30. The non-transitory computer-readable storage medium of claim 26, wherein the stored processor-executable instructions are configured to cause a processor to perform operations further comprising:

selecting a family of robust classifier models in response to determining that the user interaction event does not correlate with a user of the computing device; and

applying a plurality of behavior vectors to the selected family of robust classifier models to determine whether an activity of a software application is non-benign.