Methods and Systems for Automated Anonymous Crowdsourcing of Characterized Device Behaviors

• US 20160277435A1
• Filed: 03/18/2015
• Published: 09/22/2016
• Est. Priority Date: 03/18/2015
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Mahmoundi, Mona, Salajegheh, Mastooreh, Sridhara, Vinay, Christodorescu, Mihai, Cascaval, Gheorghe Calin
• Granted Patent: US 10,063,585 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 24/10 Scheduling measurement reports ; Arrangements for measurement reports

Abstract

Methods, and devices implementing the methods, use device-specific classifiers in a privacy-preserving behavioral monitoring and analysis system for crowd-sourcing of device behaviors. Diverse devices having varying degrees of “smart” capabilities may monitor operational behaviors. Gathered operational behavior information may be transmitted to a nearby device having greater processing capabilities than a respective collecting device, or may be transmitted directly to an “always on” device. The behavior information may be used to generate behavior vectors, which may be analyzed for anomalies. Vectors containing anomaly flags may be anonymized to remove any user-identifying information and subsequently transmitted to a remote recipient such as a service provider or device manufacture. In this manner, operational behavior information may be gathered about different devices from a large number of users, to obtain statistical analysis of operational behavior for specific makes and models of devices, without divulging personal information about device users.

Claims

1. A method of sharing device behavior information anonymously, comprising:

anonymizing, by a processor of a first device, a device behavior vector to remove user-identifying information to generate an anonymized device behavior vector in response to detecting anomalous behavior; and

transmitting, by a transceiver of the first device, the anonymized device behavior vector over a network to a remote server.

2. The method of claim 1, further comprising,

monitoring, by the processor of the first device, the behavior of a device over a period of time by collecting behavior information from device components,

building, by the processor of the first device, a device behavior vector using the collected behavior information of the device;

and

analyzing, by the processor of the first device, the device behavior vector to detect anomalous behavior.

3. The method of claim 1, further comprising:

monitoring, by a processor of a second device, the behavior of the second device over a period of time by collecting behavior information from device components;

transmitting, by a transmitter of the second device, the collected behavior information to the first device;

building, by the processor of the first device, a device behavior vector using the collected behavior information of the second device; and

analyzing, by the processor of the first device, the device behavior vector to detect anomalous behavior.

4. The method of claim 1, further comprising:

monitoring, by a processor of a second device, the behavior of the second device over a period of time by collecting behavior information from device components;

transmitting, by a transmitter of the second device, the collected behavior information to a third device;

building, by a processor of the third device, a device behavior vector using the collected behavior information received from the second device;

transmitting, by a transceiver of the third device, the device behavior vector to the first device; and

analyzing, by the processor of the first device, the device behavior vector to detect anomalous behavior.

5. The method of claim 4, further comprising:

monitoring, by the processor of a third device, behavior of the third device over a period of time by collecting behavior information from device components;

building, by the processor of the third device, a third device behavior vector using the collected behavior information of the third device;

transmitting, by a transceiver of the third device, the third device behavior vector to the first device; and

analyzing, by the processor of the first device, the third device behavior vector to detect anomalous behavior.

6. The method of claim 1, further comprising:

monitoring, by a processor of a second device, the behavior of the second device over a period of time by collecting behavior information from device components;

transmitting, by a transmitter of the second device, the collected behavior information to a third device;

building, by a processor of the third device, a device behavior vector using the collected behavior information received from the second device;

analyzing, by the processor of the third device, the device behavior vector to detect anomalous behavior; and

transmitting, by a transceiver of the third device, the device behavior vector to the first device in response to detecting anomalous behavior.

7. The method of claim 6, further comprising:

monitoring, by the processor of a third device, behavior of the third device over a period of time by collecting behavior information from device components;

building, by the processor of the third device, a third device behavior vector using the collected behavior information of the third device;

analyzing, by the processor of the third device, the third device behavior vector to detect anomalous behavior; and

transmitting, by a transceiver of the third device, the third device behavior vector to the first device in response to detecting anomalous behavior.

8. The method of claim 1, further comprising:

generating, by the processor of the first device, a feature vector in response to detecting anomalous behavior, wherein the feature vector is associated with a detected anomalous behavior;

transmitting, by the processor of the first device, the feature vector to one or more devices in local communication with a first device; and

monitoring, by processors of the one or more devices, behavior related to a feature contained in the feature vector.

9. The method of claim 1, further comprising:

receiving, by the transceiver of the first device, from a remote server, one or more feature vectors related to one or more devices in local communication with a first device;

transmitting, by the processor of the first device, the one or more feature vectors to the one or more devices in local communication with the first device; and

monitoring, by processors of the one or more devices, behavior related to a features contained in the one or more feature vector.

10. The method of claim 1, wherein anonymizing the device behavior vector includes applying to the device behavior vector an anonymizer model that is unique to the first device.

11. A multi-technology communications device comprising:

an antenna; and

a processor communicatively connected to the antenna and configured with processor-executable instructions to perform operations comprising;

anonymizing a device behavior vector of a device to remove user-identifying information to generate an anonymized device behavior vector in response to detecting anomalous behavior; and

transmitting the anonymized device behavior vector over a network to a remote server.

12. The multi-technology communication device of claim 11, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

monitoring the behavior of a device over a period of time by collecting behavior information from device components,

building a device behavior vector using the collected behavior information of the device; and

analyzing the device behavior vector to detect anomalous behavior.

13. The multi-technology communication device of claim 11, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

generating a feature vector in response to detecting anomalous behavior, wherein the feature vector is associated with a detected anomalous behavior;

transmitting the feature vector to one or more devices in local communication with a first device; and

monitoring behavior related to a feature contained in the feature vector.

14. The multi-technology communication device of claim 11, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving from a remote server, one or more feature vectors related to one or more devices in local communication with a first device;

transmitting the one or more feature vectors to the one or more devices in local communication with the first device; and

monitoring behavior related to a features contained in the one or more feature vector.

15. The multi-technology communication device of claim 11, wherein the processor is configured with processor-executable instructions to perform operations such that anonymizing the device behavior vector comprises applying to the device behavior vector an anonymizer model that is unique to the device.

16. A communications system, comprising:

a first device configured to receive and transmit data over a local wireless network and a communications network;

a second device configured to receive and transmit data over a local wireless network; and

a third device configured to transmit data over a local wireless network;

wherein the first device comprises a multi-technology communications device having a processor configured with processor-executable instructions to perform operations further comprising;

anonymizing a device behavior vector to remove user-identifying information to generate an anonymized device behavior vector in response to detecting anomalous behavior; and

transmitting the anonymized device behavior vector over a network to a remote server;

wherein the second device comprises processor configured with processor-executable instructions; and

wherein the first device comprises a device having a processor configured with processor-executable instructions.

17. The system of claim 16, wherein the processor of the first device is configured with processor-executable instructions to perform operations further comprising:

monitoring the behavior of a device over a period of time by collecting behavior information from device components,

building a device behavior vector using the collected behavior information of the device; and

analyzing the device behavior vector to detect anomalous behavior.

18. The system of claim 16, wherein:

the processor of the second device is configured with processor-executable instructions to perform operations further comprising;

monitoring the behavior of the second device over a period of time by collecting behavior information from device components; and

transmitting the collected behavior information to the first device; and

the processor of the first device is configured with processor-executable instructions to perform operations further comprising;

building a device behavior vector using the collected behavior information of the second device; and

analyzing the device behavior vector to detect anomalous behavior.

19. The system of claim 16, wherein:

the processor of the second device is configured with processor-executable instructions to perform operations further comprising;

monitoring the behavior of the second device over a period of time by collecting behavior information from device components; and

transmitting the collected behavior information to a third device;

the processor of the third device is further configured with processor-executable instructions to perform operations further comprising;

building a device behavior vector using the collected behavior information received from the second device; and

transmitting the device behavior vector to the first device; and

the processor of the first device is configured with processor-executable instructions to perform operations further comprising;

analyzing, by the processor of the first device, the device behavior vector to detect anomalous behavior.

20. The system of claim 19, wherein:

the processor of the third device is configured with processor-executable instructions to perform operations further comprising;

monitoring behavior of the third device over a period of time by collecting behavior information from device components;

building a third device behavior vector using the collected behavior information of the third device; and

transmitting the third device behavior vector to the first device; and

the processor of the first device is configured with processor-executable instructions to perform operations further comprising analyzing the third device behavior vector to detect anomalous behavior.

21. The system of claim 16, wherein:

the processor of the second device is configured with processor-executable instructions to perform operations further comprising;

monitoring the behavior of the second device over a period of time by collecting behavior information from device components;

transmitting the collected behavior information to the third device;

the processor of the third device is configured with processor-executable instructions to perform operations further comprising;

building a device behavior vector using the collected behavior information received from the second device;

analyzing the device behavior vector to detect anomalous behavior; and

transmitting the device behavior vector to the first device in response to detecting anomalous behavior.

22. The system of claim 21, wherein the processor of the third device is configured with processor-executable instructions to perform operations further comprising:

monitoring the behavior of the third device over a period of time by collecting behavior information from device components;

building a third device behavior vector using the collected behavior information of the third device;

analyzing the third device behavior vector to detect anomalous behavior; and

transmitting the third device behavior vector to the first device in response to detecting anomalous behavior.

23. The system of claim 16, wherein:

the processor of the first device is configured with processor-executable instructions to perform operations further comprising;

generating a feature vector in response to detecting anomalous behavior, wherein the feature vector is associated with a detected anomalous behavior;

transmitting the feature vector to one or more devices in local communication with a first device; and

the processors of the first, second, and third devices are further configured with processor-executable instructions to;

monitoring behavior related to a feature contained in the feature vector.

24. The system of claim 16, wherein:

the processor of the first device is configured with processor-executable instructions to perform operations further comprising;

receiving from a remote server, one or more feature vectors related to one or more devices in local communication with a first device;

transmitting the one or more feature vectors to the one or more devices in local communication with the first device; and

the processors of the first, second, and third devices are configured with processor-executable instructions to perform operations further comprising;

monitoring behavior related to a features contained in the one or more feature vector.

25. A non-transitory processor-readable medium having stored thereon processor-executable software instructions to cause a processor of a multi-technology communication device to perform operations comprising:

anonymizing a device behavior vector of a device to remove user-identifying information to generate an anonymized device behavior vector in response to detecting anomalous behavior; and

transmitting the anonymized device behavior vector over a network to a remote server.

26. The non-transitory processor-readable medium of claim 25, wherein the stored processor-executable software instructions are configured to cause a processor of a multi-technology communication device to perform operations further comprising:

monitoring the behavior of a device over a period of time by collecting behavior information from device components,

building a device behavior vector using the collected behavior information of the device; and

analyzing the device behavior vector to detect anomalous behavior.

27. The non-transitory processor-readable medium of claim 25, wherein the stored processor-executable software instructions are configured to cause a processor of a multi-technology communication device to perform operations further comprising:

generating a feature vector in response to detecting anomalous behavior, wherein the feature vector is associated with a detected anomalous behavior;

transmitting the feature vector to one or more devices in local communication with a first device; and

monitoring behavior related to a feature contained in the feature vector.

28. The non-transitory processor-readable medium of claim 25, wherein the stored processor-executable software instructions are configured to cause a processor of a multi-technology communication device to perform operations further comprising:

receiving from a remote server, one or more feature vectors related to one or more devices in local communication with a first device;

transmitting the one or more feature vectors to the one or more devices in local communication with the first device; and

monitoring behavior related to a features contained in the one or more feature vector.

29. The non-transitory processor-readable medium of claim 25, wherein the stored processor-executable software instructions are configured to cause a processor of a multi-technology communication device to perform operations such that anonymizing the device behavior vector includes applying to the device behavior vector an anonymizer model that is unique to the device.