Techniques for autonomic reverting to behavioral checkpoints

• US 9,292,685 B2
• Filed: 01/22/2013
• Issued: 03/22/2016
• Est. Priority Date: 05/14/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc., Samsung Electronics Co. Ltd.
• Original Assignee: Qualcomm, Inc.
• Inventors: Gupta, Rajarshi, Islam, Nayeem, Das, Saumitra
• Primary Examiner(s): BRYAN, JASON B
• Application Number:
  US13/747,115
• Publication Number:
  US 20130305101A1
• Time in Patent Office: 1,155 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 52/0251 using monitoring of local events, e.g. events related to user activity
• CPC Class Codes: H04W 52/0258 controlling an operation mode according to history or models of usage information, e.g. activity schedule or time of day
• CPC Class Codes: H04W 88/02 Terminal devices
• CPC Class Codes: Y02D 10/00 Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

Aspect methods, systems and devices may be configured to create/capture checkpoints without significantly impacting the performance, power consumption, or responsiveness of the mobile device. An observer module of the mobile device may instrument or coordinate various application programming interfaces (APIs) at various levels of the mobile device system and constantly monitor the mobile device (via a low power process, background processes, etc.) to identify the normal operation patterns of the mobile device and/or to identify behaviors that are not consistent with previously computed normal operation patterns. The mobile device may store mobile device state information in a memory as a stored checkpoint when it determines that the mobile device behaviors are consistent with normal operation patterns, and upload a previously stored checkpoint to a backup storage system when it determines that the mobile device behaviors are not consistent with normal operation patterns.

Claims

1. A method of checkpointing in a mobile device, comprising:

observing a mobile device behavior over a period of time to collect behavior information;

using the collected behavior information to generate a behavior vector that includes a plurality of elements that collectively characterize the observed mobile device behavior;

applying a behavior model to the generated behavior vector to generate an analysis result;

using the generated analysis result to determine whether the observed mobile device behavior is not consistent with normal operation patterns of the mobile device;

storing mobile device state information in a memory as a stored checkpoint in response to determining that the observed mobile device behavior is consistent with the normal operation patterns of the mobile device; and

uploading the stored checkpoint to a backup storage system in response to determining that the observed mobile device behavior is not consistent with the normal operation patterns.

2. The method of claim 1, wherein storing the mobile device state information in the memory as the stored checkpoint comprises storing state information for restoring the mobile device as the stored checkpoint.

3. The method of claim 1, wherein storing the mobile device state information in the memory as the stored checkpoint comprises storing state information for restoring a specific software application as the stored checkpoint.

4. The method of claim 1, further comprising:

determining whether a software application is associated with a signature; and

generating a checkpoint trigger in response to determining that the software application is not associated with the signature.

5. The method of claim 1, further comprising:

uploading the stored checkpoint to the backup storage system in response detecting a trigger generated in response to installing a software application update on the mobile device.

6. The method of claim 1, wherein uploading the stored checkpoint to the backup storage system comprises uploading the stored checkpoint to a server in a cloud service provider network.

7. The method of claim 1, further comprising:

determining whether the mobile device is associated with a WiFi access point; and

uploading the stored checkpoint to a network server in response to determining that the mobile device is associated with the WiFi access point.

8. The method of claim 1, further comprising:

determining whether the mobile device is connected to an external power source; and

uploading the stored checkpoint to a network server in response to determining that the mobile device is connected to the external power source.

9. A mobile computing device, comprising:

means for observing a mobile device behavior over a period of time to collect behavior information;

means for using the collected behavior information to generate a behavior vector that includes a plurality of elements that collectively characterize the observed mobile device behavior;

means for applying a behavior model to the generated behavior vector to generate an analysis result;

means for using the generated analysis result to determine whether the observed mobile device behavior is not consistent with normal operation patterns;

means for storing mobile device state information in a memory as a stored checkpoint in response to determining that the observed mobile device behavior is consistent with the normal operation patterns of the mobile computing device; and

means for uploading the stored checkpoint to a backup storage system in response to determining that the observed mobile device behavior is not consistent with the normal operation patterns.

10. The mobile computing device of claim 9, wherein means for storing the mobile device state information in the memory as the stored checkpoint comprises means for storing state information for restoring the mobile computing device as the stored checkpoint.

11. The mobile computing device of claim 9, wherein means for storing the mobile device state information in the memory as the stored checkpoint comprises means for storing state information for restoring a specific software application as the stored checkpoint.

12. The mobile computing device of claim 9, further comprising:

means for determining whether a software application is associated with a signature; and

means for generating a checkpoint trigger in response to determining that the software application is not associated with the signature.

13. The mobile computing device of claim 9, further comprising:

means for uploading the stored checkpoint to the backup storage system in response detecting a trigger generated in response to installing a software application update on the mobile computing device.

14. The mobile computing device of claim 9, wherein means for uploading the stored checkpoint to the backup storage system comprises means for uploading the stored checkpoint to a server in a cloud service provider network.

15. The mobile computing device of claim 9, further comprising:

means for determining whether the mobile computing device is associated with a WiFi access point; and

means for uploading the stored checkpoint to a network server in response to determining that the mobile computing device is associated with the WiFi access point.

16. The mobile computing device of claim 9, further comprising:

means for determining whether the mobile computing device is connected to an external power source; and

means for uploading the stored checkpoint to a network server in response to determining that the mobile computing device is connected to the external power source.

17. A mobile computing device, comprising:

a processor configured with processor-executable instructions to perform operations comprising;

observing a mobile device behavior over a period of time to collect behavior information;

using the collected behavior information to generate a behavior vector that includes a plurality of elements that collectively characterize the observed mobile device behavior;

applying a behavior model to the generated behavior vector to generate an analysis result;

using the generated analysis result to determine whether the observed mobile device behavior is not consistent with normal operation patterns of the mobile computing device;

storing mobile device state information in a memory as a stored checkpoint in response to determining that the observed mobile device behavior is consistent with the normal operation patterns of the mobile computing device; and

uploading the stored checkpoint to a backup storage system in response to determining that the observed mobile device behavior is not consistent with the normal operation patterns.

18. The mobile computing device of claim 17, wherein the processor is configured with processor-executable instructions to perform operations such that storing the mobile device state information in the memory as the stored checkpoint comprises storing state information for restoring the mobile computing device as the stored checkpoint.

19. The mobile computing device of claim 17, wherein the processor is configured with processor-executable instructions to perform operations such that storing the mobile device state information in the memory as the stored checkpoint comprises storing state information for restoring a specific software application as the stored checkpoint.

20. The mobile computing device of claim 17, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

determining whether a software application is associated with a signature; and

generating a checkpoint trigger in response to determining that the software application is not associated with the signature.

21. The mobile computing device of claim 17, wherein the processor is configured with processor-executable instructions to perform operations such that further comprising:

uploading the stored checkpoint in response detecting a trigger generated in response to installing a software application update on the mobile computing device.

22. The mobile computing device of claim 17, wherein the processor is configured with processor-executable instructions to perform operations such that uploading the stored checkpoint to the backup storage system comprises uploading the stored checkpoint to a server in a cloud service provider network.

23. The mobile computing device of claim 17, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

determining whether the mobile computing device is associated with a WiFi access point; and

uploading the stored checkpoint to a network server in response to determining that the mobile computing device is associated with the WiFi access point.

24. The mobile computing device of claim 17, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

determining whether the mobile computing device is connected to an external power source; and

uploading the stored checkpoint to a network server in response to determining that the mobile computing device is connected to the external power source.

25. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor to perform operations for checkpointing in a mobile device, the operations comprising:

observing a mobile device behavior over a period of time to collect behavior information;

using the collected behavior information to generate a behavior vector that includes a plurality of elements that collectively characterize the observed mobile device behavior;

applying a behavior model to the generated behavior vector to generate an analysis result;

using the generated analysis result to determine whether the observed mobile device behavior is not consistent with normal operation patterns;

storing mobile device state information in a memory as a stored checkpoint in response to determining that the observed mobile device behavior is consistent with the normal operation patterns of the mobile device; and

uploading the stored checkpoint to a backup storage system in response to determining that the observed mobile device behavior is not consistent with the normal operation patterns.

26. The non-transitory computer readable storage medium of claim 25, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that storing the mobile device state information in the memory as the stored checkpoint comprises storing state information for restoring the mobile device as the stored checkpoint.

27. The non-transitory computer readable storage medium of claim 25, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that storing the mobile device state information in the memory as the stored checkpoint comprises storing state information for restoring a specific software application as the stored checkpoint.

28. The non-transitory computer readable storage medium of claim 25, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

determining whether a software application is associated with a signature; and

generating a checkpoint trigger in response to determining that the software application is not associated with the signature.

29. The non-transitory computer readable storage medium of claim 25, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

uploading the stored checkpoint in response detecting a trigger generated in response to installing a software application update on the mobile device.

30. The non-transitory computer readable storage medium of claim 25, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that uploading the stored checkpoint to the backup storage system comprises uploading the stored checkpoint to a server in a cloud service provider network.

31. The non-transitory computer readable storage medium of claim 25, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

determining whether the mobile device is associated with a WiFi access point; and

uploading the stored checkpoint to a network server in response to determining that the mobile device is associated with the WiFi access point.

32. The non-transitory computer readable storage medium of claim 25, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

determining whether the mobile device is connected to an external power source; and

uploading the stored checkpoint to a network server in response to determining that the mobile device is connected to the external power source.