Adaptive observation of behavioral features on a heterogeneous platform

• US 9,189,624 B2
• Filed: 05/02/2014
• Issued: 11/17/2015
• Est. Priority Date: 05/14/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Gathala, Anil, Gupta, Rajarshi
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Khan, Sher A
• Application Number:
  US14/268,547
• Publication Number:
  US 20140245306A1
• Time in Patent Office: 564 Days
• Field of Search: 726 22- 25
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 52/0251 using monitoring of local events, e.g. events related to user activity
• CPC Class Codes: H04W 52/0258 controlling an operation mode according to history or models of usage information, e.g. activity schedule or time of day
• CPC Class Codes: H04W 88/02 Terminal devices
• CPC Class Codes: Y02D 10/00 Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

Methods, devices and systems for monitoring behaviors of a mobile computing device include observing in a non-master processing core a portion of a mobile device behavior that is relevant to the non-master processing core, generating a behavior signature that describes the observed portion of the mobile device behavior, and sending the generated behavior signature to a master processing core. The master processing core combines two or more behavior signatures received from the non-master processing cores to generate a global behavior vector, which may be used by an analyzer module to determine whether a distributed software application is not benign.

Claims

1. A method of monitoring behaviors of a computing device that includes heterogeneous processing cores, comprising:

repeatedly monitoring in a non-master processing core of the computing device activities of a software application to collect behavior information on a partial behavior of the software application;

using the collected behavior information to generate in the non-master processing core a behavior signature that describes the partial behavior of the software application in a vector data-structure;

generating a task graph in a master processing core of the computing device; and

generating a global behavior vector data-structure that describes a complete behavior of the software application in the master processing core by using the generated task graph to combine two or more behavior signatures generated in non-master processing cores that each describe a partial behavior of the software application in a vector data-structure.

2. The method of claim 1, further comprising:

determining whether the software application is not benign based on the global behavior vector.

3. The method of claim 1, further comprising:

monitoring in the master processing core a distribution of sub-tasks of the software application to a plurality of non-master processing cores of the computing device.

4. The method of claim 3, wherein monitoring the distribution of sub-tasks comprises monitoring calls to a transport layer of the computing device.

5. A computing device, comprising:

a master processor; and

one or more non-master processors coupled to the master processor,

wherein each of the one or more non-master processors are configured with processor-executable instructions to perform operations comprising;

repeatedly monitoring activities of a software application to collect behavior information on a partial behavior of the software application; and

using the collected behavior information to generate a behavior signature that describes the observed partial behavior of the software application in a vector data-structure, and

wherein the master processor is configured with processor-executable instructions to perform operations comprising;

generating a task graph; and

generating a global behavior vector data-structure that describes a complete behavior of the software application by using the generated task graph to combine two or more behavior signatures generated in non-master processing cores that each describe a partial behavior of the software application in a vector data-structure.

6. The computing device of claim 5, wherein the master processor is configured with processor-executable instructions to perform operations further comprising:

determining whether the software application is not benign based on the global behavior vector.

7. The computing device of claim 5, wherein the master processor is configured with

processor-executable instructions to perform operations further comprising:

monitoring a distribution of sub-tasks of the software application to the one or more non-master processors.

8. The computing device of claim 7, wherein the master processor is configured with processor-executable instructions to perform operations such that monitoring the distribution of sub-tasks comprises monitoring calls to a transport layer of the computing device.

9. A computing device having multiple heterogeneous processing cores, comprising:

means for repeatedly monitoring in a non-master processing core of the computing device activities of a software application to collect behavior information on a partial behavior of the software application;

means for using the collected behavior information to generate in the non-master processing core a behavior signature that describes the observed partial behavior of the software application in a vector data-structure;

means for generating a task graph in a master processing core of the computing device; and

means for generating a global behavior vector data-structure that describes a complete behavior of the software application in the master processing core by using the generated task graph to combine two or more behavior signatures generated in non-master processing cores that each describe a partial behavior of the software application in a vector data-structure.

10. The computing device of claim 9, further comprising:

means for determining whether the software application is not benign based on the global behavior vector.

11. The computing device of claim 9, further comprising:

means for monitoring in the master processing core a distribution of sub-tasks of the software application to one or more non-master processing cores.

12. The computing device of claim 11, wherein means for monitoring the distribution of sub-tasks comprises means for monitoring calls to a transport layer of the computing device.

13. A non-transitory processor readable storage medium having stored thereon processor-executable software instructions configured to cause a computing device to perform operations comprising:

repeatedly monitoring in a non-master processor of the computing device activities of a software application to collect behavior information on a partial behavior of the software application;

using the collected behavior information to generate in the non-master processor a behavior signature that describes the observed partial behavior of the software application in a vector data-structure;

generating a task graph in a master processing core of the computing device; and

generating a global behavior vector data-structure that describes a complete behavior of the software application in the master processing core by using the generated task graph to combine two or more behavior signatures generated in non-master processing cores that each describe a partial behavior of the software application in a vector data-structure.

14. The non-transitory processor readable storage medium of claim 13, wherein the stored processor-executable software instructions are configured to cause the computing device to perform operations further comprising:

determining whether the software application is not benign based on the global behavior vector.

15. The non-transitory processor readable storage medium of claim 13, wherein the stored processor-executable software instructions are configured to cause the computing device to perform operations further comprising:

monitoring in the master processor a distribution of sub-tasks of the software application to one or more non-master processors.

16. The non-transitory processor readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause the computing device to perform operations such that monitoring the distribution of sub-tasks comprises monitoring calls to a transport layer of the computing device.