Collaborative learning for efficient behavioral analysis in networked mobile device

• US 9,298,494 B2
• Filed: 03/14/2013
• Issued: 03/29/2016
• Est. Priority Date: 05/14/2012
• Status: Expired due to Fees

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Gathala, Anil, Gupta, Rajarshi
• Primary Examiner(s): TAYLOR, BARRY W
• Application Number:
  US13/804,518
• Publication Number:
  US 20130303159A1
• Time in Patent Office: 1,111 Days
• Field of Search: 455/410, 455/423, 455/425, 455/411
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3013 where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems testing or monitoring of control systems or parts thereof G05B23/02
• CPC Class Codes: G06F 11/3062 where the monitored property is the power consumption power management in a computing system G06F1/3203
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: G06N 5/043 Distributed expert systems; Blackboards
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 24/02 Arrangements for optimising operational condition
• CPC Class Codes: H04W 52/0209 in terminal devices terminal devices per se H04W88/02

Abstract

Methods, systems and devices for classifying mobile device behaviors of a first mobile device may include the first mobile device monitoring mobile device behaviors to generate a behavior vector, and applying the behavior vector to a first classifier model to obtain a first determination of whether a mobile device behavior is benign or not benign. The first mobile device may also send the behavior vector to a second mobile device, which may receive and apply the behavior vector to a second classifier model to obtain a second determination of whether the mobile device behavior is benign or not benign. The second mobile device may send the second determination to the first mobile device, which may receive the second determination, collate the first determination and the second determination to generate collated results, and determine whether the mobile device behavior is benign or not benign based on the collated results.

Claims

1. A method of classifying mobile device behaviors of a mobile device, comprising:

monitoring mobile device behaviors in a first mobile device to generate a behavior vector data structure that characterizes a behavior of a software application operating on the first mobile device;

applying the behavior vector data structure to a first classifier model in the first mobile device to obtain a first determination of a classification of the behavior of the software application operating on the first mobile device;

sending the behavior vector data structure to a second mobile device, the second mobile device applying the behavior vector data structure received from the first mobile device to a second classifier model to obtain a second determination in the second mobile device of the classification of the behavior of the software application operating on the first mobile device and sending the second determination to the first mobile device;

collating the first determination and the second determination in the first mobile device to generate collated results; and

classifying the behavior of the software application operating on the first mobile device based on the collated results.

2. The method of claim 1, wherein the first mobile device and the second mobile device are in the same local network.

3. The method of claim 1, wherein sending the behavior vector data structure to the second mobile device comprises broadcasting the behavior vector data structure to all mobile devices on the same local network.

4. The method of claim 1, wherein collating the first determination and the second determination in the first mobile device to generate the collated results comprises generating a weighted linear combination of the first determination and the second determination.

5. The method of claim 1, wherein collating the first determination and the second determination in the first mobile device to generate the collated results comprises:

multiplying the first determination by a first confidence value to generate a first result;

multiplying the second determination by a second confidence value to generate a second result; and

summing the first result with the second result,

wherein the first confidence value is determined by the first classifier model, and

wherein the second confidence value is determined by the second classifier model in the second mobile device and sent to the first mobile device along with the second determination.

6. The method of claim 1, further comprising:

joining a trust network that includes a plurality of trusted mobile devices by performing group formation operations that include establishing direct communication links to each of the plurality of trusted mobile devices via WiFi-Direct technologies, wherein sending the behavior vector data structure to the second mobile device comprises sending the behavior vector data structure to one of the plurality of trusted mobile devices.

7. The method of claim 1, wherein:

applying the behavior vector data structure to the first classifier model in the first mobile device to obtain the first determination of the classification of the behavior of the software application operating on the first mobile device comprises applying the behavior vector data structure to the first classifier model in the first mobile device to obtain a determination of whether the behavior of the software application operating on the first mobile device is not benign; and

classifying the behavior of the software application operating on the first mobile device based on the collated results comprises determining whether the behavior of the software application operating on the first mobile device is not benign based on the collated results.

8. A mobile device comprising:

means for monitoring mobile device behaviors to generate a behavior vector data structure that characterizes a behavior of a software application operating on the mobile device;

means for applying the behavior vector data structure to a first classifier model to obtain a first determination of a classification of the behavior of the software application operating on the mobile device;

means for sending the behavior vector data structure to a second mobile device and causing the second mobile device to apply the behavior vector data structure to a second classifier model to obtain a second determination of the classification of the behavior of the software application operating on the mobile device;

means for receiving the second determination from the second mobile device in response to sending the behavior vector data structure to the second mobile device;

means for collating the first determination and the second determination to generate collated results; and

means for classifying the behavior of the software application operating on the mobile device based on the collated results.

9. The mobile device of claim 8, wherein means for sending the behavior vector data structure to the second mobile device comprises means for sending the behavior vector data structure to a mobile computing device in a local network.

10. The mobile device of claim 8, wherein means for sending the behavior vector data structure to the second mobile device comprises means for broadcasting the behavior vector data structure to all mobile devices in a local network.

11. The mobile device of claim 8, wherein means for collating the first determination and the second determination to generate the collated results comprises means for generating a weighted linear combination of the first determination and the second determination.

12. The mobile device of claim 8, wherein means for collating the first determination and the second determination to generate the collated results comprises:

means for multiplying the first determination by a first confidence value to generate a first result;

means for multiplying the second determination by a second confidence value to generate a second result; and

means for summing the first result with the second result,

wherein the first confidence value is determined by the first classifier model, and

wherein the second confidence value is determined by the second classifier model in the second mobile device and sent to the mobile device along with the second determination.

13. The mobile device of claim 8, further comprising:

means for joining a trust network that includes a plurality of trusted mobile devices by performing group formation operations that include establishing direct communication links to each of the plurality of trusted mobile devices via WiFi-Direct technologies, and wherein means for sending the behavior vector data structure to the second mobile device comprises means for sending the behavior vector data structure to one of the plurality of trusted mobile devices.

14. The mobile device of claim 8, wherein:

means for applying the behavior vector data structure to the first classifier model to obtain the first determination of the classification of the behavior of the software application operating on the mobile device comprises means for applying the behavior vector data structure to the first classifier model to obtain a determination of whether the behavior of the software application operating on the mobile device is not benign; and

means for classifying the behavior of the software application operating on the mobile device based on the collated results comprises means for determining whether the behavior of the software application operating on the mobile device is not benign based on the collated results.

15. A mobile device, comprising:

a processor configured with processor-executable instructions to perform operations comprising;

monitoring mobile device behaviors to generate a behavior vector data structure that characterizes a behavior of a software application operating on the mobile device;

applying the behavior vector data structure to a first classifier model to obtain a first determination of a classification of the behavior of the software application operating on the mobile device;

sending the behavior vector data structure to a second mobile device so as to cause the second mobile device to apply the behavior vector data structure to a second classifier model to obtain a second determination of the classification of the behavior of the software application operating on the mobile device;

receiving the second determination from the second mobile device in response to sending the behavior vector data structure to the second mobile device;

collating the first determination and the second determination to generate collated results; and

classifying the behavior of the software application operating on the mobile device based on the collated results.

16. The mobile device of claim 15, wherein the processor is configured with processor-executable instructions to perform operations such that sending the behavior vector data structure to the second mobile device comprises sending the behavior vector data structure to a mobile computing device in a local network.

17. The mobile device of claim 15, wherein the processor is configured with processor-executable instructions to perform operations such that sending the behavior vector data structure to the second mobile device comprises broadcasting the behavior vector data structure to all mobile devices in a local network.

18. The mobile device of claim 15, wherein the processor is configured with processor-executable instructions to perform operations such that collating the first determination and the second determination to generate the collated results comprises generating a weighted linear combination of the first determination and the second determination.

19. The mobile device of claim 15, wherein the processor is configured with processor-executable instructions to perform operations such that collating the first determination and the second determination to generate the collated results comprises:

multiplying the first determination by a first confidence value to generate a first result;

multiplying the second determination by a second confidence value to generate a second result; and

summing the first result with the second result,

wherein the first confidence value is determined by the first classifier model, and

wherein the second confidence value is determined by the second classifier model in the second mobile device and sent to the mobile device along with the second determination.

20. The mobile device of claim 15, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

joining a trust network that includes a plurality of trusted mobile devices by performing group formation operations that include establishing direct communication links to each of the plurality of trusted mobile devices via WiFi-Direct technologies, wherein sending the behavior vector data structure to the second mobile device comprises sending the behavior vector data structure to one of the plurality of trusted mobile devices.

21. The mobile device of claim 15, wherein the processor is configured with processor- executable instructions to perform operations such that:

applying the behavior vector data structure to the first classifier model to obtain the first determination of the classification of the behavior of the software application operating on the mobile device comprises applying the behavior vector data structure to the first classifier model to obtain a determination of whether the behavior of the software application operating on the mobile device is not benign; and

classifying the behavior of the software application operating on the mobile device based on the collated results comprises determining whether the behavior of the software application operating on the mobile device is not benign based on the collated results.

27. The non-transitory computer readable storage medium of claim 19, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations further comprising:

joining a trust network that includes a plurality of trusted mobile devices by performing group formation operations that include establishing direct communication links to each of the plurality of trusted mobile devices via WiFi-Direct technologies, wherein sending the behavior vector data structure to the second mobile device comprises sending the behavior vector data structure to one of the plurality of trusted mobile devices.

22. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a mobile device processor in a mobile device to perform operations comprising:

monitoring mobile device behaviors to generate a behavior vector data structure that characterizes a behavior of a software application operating on the mobile device;

applying the behavior vector data structure to a first classifier model to obtain a first determination of a classification of the behavior of the software application operating on the mobile device;

sending the behavior vector data structure to a second mobile device so as to cause the second mobile device to apply the behavior vector data structure to a second classifier model to obtain a second determination of the classification of the behavior of the software application operating on the mobile device;

receiving the second determination from the second mobile device in response to sending the behavior vector data structure to the second mobile device;

collating the first determination and the second determination to generate collated results; and

classifying the behavior of the software application operating on the mobile device based on the collated results.

23. The non-transitory computer readable storage medium of claim 22, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations such that sending the behavior vector data structure to the second mobile device comprises sending the behavior vector data structure to a mobile computing device in a local network.

24. The non-transitory computer readable storage medium of claim 22, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations such that sending the behavior vector data structure to the second mobile device comprises broadcasting the behavior vector data structure to all mobile devices in a local network.

25. The non-transitory computer readable storage medium of claim 22, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations such that collating the first determination and the second determination to generate the collated results comprises generating a weighted linear combination of the first determination and the second determination.

26. The non-transitory computer readable storage medium of claim 22, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations such that collating the first determination and the second determination to generate the collated results comprises:

multiplying the first determination by a first confidence value to generate a first result;

multiplying the second determination by a second confidence value to generate a second result; and

summing the first result with the second result,

wherein the first confidence value is determined by the first classifier model, and

wherein the second confidence value is determined by the second classifier model in the second mobile device and sent to the mobile device processor along with the second determination.

28. The non-transitory computer readable storage medium of claim 22, wherein the stored processor-executable software instructions are configured to cause the mobile device processor to perform operations such that:

applying the behavior vector data structure to the first classifier model to obtain the first determination of the classification of the behavior of the software application operating on the mobile device comprises applying the behavior vector data structure to the first classifier model to obtain a determination of whether the behavior of the software application operating on the mobile device is not benign; and

classifying the behavior of the software application operating on the mobile device based on the collated results comprises determining whether the behavior of the software application operating on the mobile device is not benign based on the collated results.