Adaptive observation of behavioral features on a heterogeneous platform

• US 9,152,787 B2
• Filed: 02/22/2013
• Issued: 10/06/2015
• Est. Priority Date: 05/14/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Gathala, Anil, Gupta, Rajarshi Paul
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Khan, Sher A
• Application Number:
  US13/773,877
• Publication Number:
  US 20130305359A1
• Time in Patent Office: 956 Days
• Field of Search: 726 22- 25
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 52/0251 using monitoring of local events, e.g. events related to user activity
• CPC Class Codes: H04W 52/0258 controlling an operation mode according to history or models of usage information, e.g. activity schedule or time of day
• CPC Class Codes: H04W 88/02 Terminal devices
• CPC Class Codes: Y02D 10/00 Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

Methods, devices and systems for monitoring behaviors of a mobile computing device include observing in a non-master processing core a portion of a mobile device behavior that is relevant to the non-master processing core, generating a behavior signature that describes the observed portion of the mobile device behavior, and sending the generated behavior signature to a master processing core. The master processing core combines two or more behavior signatures received from the non-master processing cores to generate a global behavior vector, which may be used by an analyzer module to determine whether a distributed software application is benign or not benign.

Claims

1. A method of monitoring behaviors of a mobile computing device, comprising:

repeatedly monitoring in a non-master processing core of the mobile computing device activities of a software application to collect behavior information on a partial behavior of the software application;

using the collected behavior information to generate in the non-master processing core a behavior signature that describes the partial behavior of the software application in a vector data-structure;

sending the generated behavior signature to a master processing core of the mobile computing device;

generating a task graph in the master processing core of the computing device;

using the generated task graph to combine two or more behavior signatures that each describe a different partial behavior of the software application in a vector data-structure received from non-master processing cores in the master processing core to generate a global behavior vector data-structure that describes the complete behavior of the software application; and

providing the global behavior vector to an analyzer module for processing.

2. The method of claim 1, further comprising processing the global behavior vector by the analyzer module to determine whether the software application is not benign based on the global behavior vector.

3. The method of claim 1, further comprising:

monitoring in the master processing core a distribution of sub-tasks of the software application to a plurality of non-master processing cores of the mobile computing device.

4. The method of claim 3, wherein monitoring the distribution of sub-tasks comprises monitoring calls to a transport layer of the mobile device.

5. A mobile computing device, comprising:

a memory;

a master processor; and

one or more non-master processors coupled to the memory and the master processor,

wherein each of the one or more non-master processors are configured with processor-executable instructions to perform operation comprising;

repeatedly monitoring activities of a software application to collect behavior information on a partial behavior of the software application;

using the collected behavior information to generate a behavior signature that describes the partial behavior of the software application in a vector data-structure; and

sending the generated behavior signature to the master processor, and

wherein the master processor is configured with processor-executable instructions to perform operations comprising;

generating a task graph;

using the generated task graph to combine two or more behavior signatures that each describe a different partial behavior of the software application in a vector data-structure received from the one or more non-master processors to generate a global behavior vector data-structure that describes the complete behavior of the software application; and

providing the global behavior vector to an analyzer module for processing.

6. The mobile computing device of claim 5, wherein the master processor is configured with processor-executable instructions to perform operations further comprising:

processing the global behavior vector by the analyzer module to determine whether the software application is not benign based on the global behavior vector in the analyzer module.

7. The mobile computing device of claim 5, wherein the master processor is configured with processor-executable instructions to perform operations further comprising:

monitoring a distribution of sub-tasks of the software application to the one or more non-master processors.

8. The mobile computing device of claim 7, wherein the master processor is configured with processor-executable instructions to perform operations such that monitoring the distribution of sub-tasks comprises monitoring calls to a transport layer of the mobile computing device.

9. A mobile computing device having multiple heterogeneous cores, comprising:

means for repeatedly monitoring in a non-master processing core activities of a software application to collect behavior information on a partial behavior of the software application;

means for using the collected behavior information to generate in the non-master processing core a behavior signature that describes the partial behavior of the software application in a vector data-structure;

means for sending the generated behavior signature to a master processing core;

means for generating a task graph in the master processing core;

means for using the generated task graph to combine two or more behavior signatures that each describe a different partial behavior of the software application in a vector data-structure received from non-master processing cores in the master processing core to generate a global behavior vector data-structure that describes the complete behavior of the software application; and

means for providing the global behavior vector to an analyzer module for processing.

10. The mobile computing device of claim 9, further comprising means for processing the global behavior vector by the analyzer module to determine whether the software application is not benign based on the global behavior vector.

11. The mobile computing device of claim 9, further comprising:

means for monitoring in the master processing core a distribution of subtasks of the software application to one or more non-master processing cores.

12. The mobile computing device of claim 11, wherein means for monitoring the distribution of sub-tasks comprises means for monitoring calls to a transport layer of the mobile computing device.

13. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a multiprocessor computing system to perform operations comprising:

repeatedly monitoring in a non-master processor activities of a software application to collect behavior information on a partial behavior of the software application;

using the collected behavior information to generate in the non-master processor a behavior signature that describes the partial behavior of the software application in a vector data-structure;

sending the generated behavior signature to a master processor;

generating a task graph in the master processor;

using the generated task graph to combine two or more behavior signatures that each describe a different partial behavior of the software application in a vector data-structure received from two or more non-master processors in the master processor to generate a global behavior vector data-structure that describes the complete behavior of the software application; and

providing the global behavior vector to an analyzer module for processing.

14. The non-transitory computer readable storage medium of claim 13, wherein the stored processor-executable software instructions are configured to cause the multiprocessor computing system to perform operations further comprising processing the global behavior vector by the analyzer module to determine whether the software application is not benign based on the global behavior vector.

15. The non-transitory computer readable storage medium of claim 13, wherein the stored processor-executable software instructions are configured to cause the multiprocessor computing system to perform operations further comprising:

monitoring in the master processor a distribution of sub-tasks of the software application to one or more non-master processing cores.

16. The non-transitory computer readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause the multiprocessor computing system to perform operations such that monitoring the distribution of sub-tasks comprises monitoring calls to a transport layer of mobile device.