System, apparatus, and method for adaptive observation of mobile device behavior

• US 9,202,047 B2
• Filed: 09/26/2012
• Issued: 12/01/2015
• Est. Priority Date: 05/14/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Gupta, Rajarshi, Gathala, Sudha Anil, Halambi, Soorgoli Ashok
• Primary Examiner(s): RAMPURIA, SHARAD K
• Application Number:
  US13/627,401
• Publication Number:
  US 20130303154A1
• Time in Patent Office: 1,161 Days
• Field of Search: 455410-411, 4554221-425
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 52/0251 using monitoring of local events, e.g. events related to user activity
• CPC Class Codes: H04W 52/0258 controlling an operation mode according to history or models of usage information, e.g. activity schedule or time of day
• CPC Class Codes: H04W 88/02 Terminal devices
• CPC Class Codes: Y02D 10/00 Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

Methods, devices and systems for detecting suspicious or performance-degrading mobile device behaviors intelligently, dynamically, and/or adaptively determine computing device behaviors that are to be observed, the number of behaviors that are to be observed, and the level of detail or granularity at which the mobile device behaviors are to be observed. The various aspects efficiently identify suspicious or performance-degrading mobile device behaviors without requiring an excessive amount of processing, memory, or energy resources. Various aspects may correct suspicious or performance-degrading mobile device behaviors. Various aspects may prevent identified suspicious or performance-degrading mobile device behaviors from degrading the performance and power utilization levels of a mobile device over time. Various aspects may restore an aging mobile device to its original performance and power utilization levels.

Claims

1. A method for observing mobile device behaviors over a period of time to recognize mobile device behaviors inconsistent with normal operation patterns, the method comprising:

dynamically determining in a processor of a mobile device mobile device behaviors that are to be observed by;

observing mobile device behaviors over the period of time; and

identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed by;

receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface (API) after filtering by an adaptive filter;

receiving a context input regarding operations of the mobile device;

performing spatial correlations of the received behavior inputs and the received context input; and

generating a behavior vector;

adaptively observing the determined mobile device behaviors to identify a suspicious mobile device behavior from a limited set of observations; and

controlling an observation granularity of the adaptive observation.

2. The method of claim 1, wherein operations of dynamically determining mobile device behaviors that are to be observed and controlling the observation granularity of the adaptive observation are accomplished via an observer daemon operating within the system kernel.

3. The method of claim 1, wherein:

identifying the limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed comprises performing temporal correlations of the received behavior inputs and the received context input; and

generating the behavior vector comprises generating the behavior vector based on a result of the spatial and temporal correlations.

4. The method of claim 1, wherein identifying the limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed comprises storing the generated behavior vector in a secure memory.

5. A mobile computing device, comprising:

a processor configured with processor-executable instructions to perform operations comprising;

dynamically determining mobile device behaviors that are to be observed by;

observing mobile device behaviors over a period of time; and

identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed by;

receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface (API) after filtering by an adaptive filter;

receiving a context input regarding operations of the mobile device;

performing spatial correlations of the received behavior inputs and the received context input; and

generating a behavior vector;

adaptively observing the determined mobile device behaviors to identify a suspicious mobile device behavior from a limited set of observations; and

controlling an observation granularity of the adaptive observation.

6. The mobile computing device of claim 5, wherein the processor is configured with processor-executable instructions to perform operations such that the operations of dynamically determining mobile device behaviors that are to be observed and controlling the observation granularity of the adaptive observation are accomplished via an observer daemon operating within the system kernel.

7. The mobile computing device of claim 5, wherein the processor is configured with processor-executable instructions to perform operations such that:

identifying the limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed comprises performing temporal correlations of the received behavior inputs and the received context input; and

generating the behavior vector comprises generating the behavior vector based on a result of the spatial and temporal correlations.

8. The mobile computing device of claim 5, wherein the processor is configured with processor-executable instructions to perform operations such that identifying the limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed comprises storing the generated behavior vector in a secure memory.

9. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor of a mobile device to perform operations comprising:

dynamically determining mobile device behaviors that are to be observed by;

observing mobile device behaviors over a period of time; and

identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed by;

receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface (API) after filtering by an adaptive filter;

receiving a context input regarding operations of the mobile device;

performing spatial correlations of the received behavior inputs and the received context input; and

generating a behavior vector;

adaptively observing the determined mobile device behaviors to identify a suspicious mobile device behavior from a limited set of observations; and

controlling an observation granularity of the adaptive observation.

10. The non-transitory computer readable storage medium of claim 9, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that the operations of dynamically determining mobile device behaviors that are to be observed and controlling the observation granularity of the adaptive observation are accomplished via an observer daemon operating within the system kernel.

11. The non-transitory computer readable storage medium of claim 9, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that:

identifying the limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed comprises performing temporal correlations of the received behavior inputs and the received context input; and

generating the behavior vector comprises generating the behavior vector based on a result of the spatial and temporal correlations.

12. The non-transitory computer readable storage medium of claim 9, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that identifying the limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed comprises storing the generated behavior vector in a secure memory.

13. A method of improving performance on a mobile device, comprising:

performing on a mobile device processor real-time behavior analysis of mobile device behaviors to generate coarse observations;

identifying suspicious behavior from the coarse observations;

dynamically determining the mobile device behaviors that require further observation in greater detail by;

receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface (API) after filtering by an adaptive filter;

receiving a context input regarding operations of the mobile device;

performing spatial correlations of the received behavior inputs and the received context input; and

generating a behavior vector;

dynamically determining a level of detail required for the further observation;

performing finer observations based on the determined level of detail required for the further observation; and

identifying suspicious behavior from the finer observations.

14. The method of claim 13, further comprising:

performing mobile devices operations to correct the identified suspicious behavior.

15. The method of claim 13, wherein performing spatial correlations of the received behavior inputs and the received context input comprises performing spatial and temporal correlations of observed mobile device behaviors to detect high-level mobile device behaviors.

16. A mobile computing device, comprising:

a processor configured with processor-executable instructions to perform operations comprising;

performing real-time behavior analysis of mobile device behaviors to generate coarse observations;

identifying suspicious behavior from the coarse observations;

dynamically determining the mobile device behaviors that require further observation in greater detail by;

receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface (API) after filtering by an adaptive filter;

receiving a context input regarding operations of the mobile computing device;

performing spatial correlations of the received behavior inputs and the received context input; and

generating a behavior vector;

dynamically determining a level of detail required for the further observation;

performing finer observations based on the determined level of detail required for the further observation; and

identifying suspicious behavior from the finer observations.

17. The mobile computing device of claim 16, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

performing mobile devices operations to correct the identified suspicious behavior.

18. The mobile computing device of claim 16, wherein the processor is configured with processor-executable instructions to perform operations such that performing spatial correlations of the received behavior inputs and the received context input comprises performing spatial and temporal correlations of observed mobile device behaviors to detect high-level mobile device behaviors.

19. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor of a mobile device to perform operations comprising:

performing real-time behavior analysis of mobile device behaviors to generate coarse observations;

identifying suspicious behavior from the coarse observations;

dynamically determining the mobile device behaviors that require further observation in greater detail by;

receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface (API) after filtering by an adaptive filter;

receiving a context input regarding operations of the mobile device;

performing spatial correlations of the received behavior inputs and the received context input; and

generating a behavior vector;

dynamically determining a level of detail required for the further observation;

performing finer observations based on the determined level of detail required for the further observation; and

identifying suspicious behavior from the finer observations.

20. The non-transitory computer readable storage medium of claim 19, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations comprising:

performing mobile devices operations to correct the identified suspicious behavior.

21. The non-transitory computer readable storage medium of claim 19, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that performing spatial correlations of the received behavior inputs and the received context input comprises performing spatial and temporal correlations of observed mobile device behaviors to detect high-level mobile device behaviors.