On-device real-time behavior analyzer

• US 9,324,034 B2
• Filed: 02/21/2013
• Issued: 04/26/2016
• Est. Priority Date: 05/14/2012
• Status: Expired due to Fees

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Gupta, Rajarshi, Wei, Xuetao, Gathala, Anil, Sridhara, Vinay
• Primary Examiner(s): Chaki, Kakali
• Assistant Examiner(s): Gonzales, Vincent
• Application Number:
  US13/773,247
• Publication Number:
  US 20130304676A1
• Time in Patent Office: 1,160 Days
• US Class Current: 1/1
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/043 Distributed expert systems; Blackboards

Abstract

Methods, systems and devices for generating data models in a communication system may include applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors. Such behavior vectors may be used to compute a weight value for one or more nodes of the boosted decision tree. Classifier models factors having a high probably of determining whether a mobile device behavior is benign or not benign based on the computed weight values may be identified. Computing weight values for boosted decision tree nodes may include computing an exclusive answer ratio for generated boosted decision tree nodes. The identified factors may be applied to the corpus of behavior vectors to generate a second family of classifier models identifying fewer factors and data points relevant for enabling the mobile device to determine whether a behavior is benign or not benign.

Claims

1. A method of generating data models in a communication system, comprising:

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an exclusive answer ratio for one or more nodes of the boosted decision tree; and

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed exclusive answer ratios.

2. The method of claim 1, further comprising:

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

generating a mobile device classifier based on the second family of classifier models.

3. The method of claim 2, further comprising:

sending the mobile device classifier to a mobile computing device.

4. The method of claim 3, further comprising:

receiving the mobile device classifier in a device processor of the mobile computing device; and

classifying in the device processor a behavior of the mobile computing device based on the received mobile device classifier.

5. A communication system, comprising:

a server comprising;

means for applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

means for computing an exclusive answer ratio for one or more nodes of the boosted decision tree;

means for determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed exclusive answer ratios;

means for applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign;

means for generating a mobile device classifier based on the second family of classifier models; and

means for sending the generated mobile device classifier to the mobile device; and

a mobile computing device, comprising;

means for sending behavior vectors to the server;

means for receiving the mobile device classifier from the server; and

means for classifying a behavior of the mobile computing device based on the received mobile device classifier.

6. A communication system, comprising:

a server comprising a server processor configured with server-executable instructions to perform operations comprising;

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an exclusive answer ratio for one or more nodes of the boosted decision tree;

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed exclusive answer ratios;

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign;

generating a mobile device classifier based on the second family of classifier models; and

sending the generated mobile device classifier to the mobile device; and

a mobile computing device comprising a device processor configured with processor-executable instructions to perform operations comprising;

sending behavior vectors to the server;

receiving the mobile device classifier from the server; and

classifying a behavior of the mobile computing device based on the received mobile device classifier.

7. A server, comprising:

means for applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

means for computing an exclusive answer ratio for one or more nodes of the boosted decision tree; and

means for determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed exclusive answer ratios.

8. The server of claim 7, wherein further comprising:

means for applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

means for generating a mobile device classifier based on the second family of classifier models.

9. The server of claim 8, wherein further comprising:

means for sending the generated mobile device classifier to a mobile computing device.

10. A server, comprising:

a processor configured with processor-executable instructions to perform operations comprising;

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an exclusive answer ratio for one or more nodes of the boosted decision tree; and

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed exclusive answer ratios.

11. The server of claim 10, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

generating a mobile device classifier based on the second family of classifier models.

12. The server of claim 11, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

sending the generated mobile device classifier to a mobile computing device.

13. A non-transitory computer readable storage medium having stored thereon server-executable software instructions configured to cause a server processor to perform operations for generating data models in a communication system, comprising:

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an exclusive answer ratio for one or more nodes of the boosted decision tree; and

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on the computed exclusive answer ratios.

14. The non-transitory computer readable storage medium of claim 13, wherein the stored server-executable software instructions are configured to cause the server processor to perform operations further comprising:

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

generating a mobile device classifier based on the second family of classifier models.

15. The non-transitory computer readable storage medium of claim 14, wherein the stored server-executable software instructions are configured to cause the server processor to perform operations further comprising:

sending the generated mobile device classifier to a mobile computing device.

16. A method of generating data models in a communication system, comprising:

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an answer ratio for one or more nodes of the boosted decision tree; and

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed answer ratios.

17. The method of claim 16, further comprising:

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

generating a mobile device classifier based on the second family of classifier models.

18. The method of claim 17, further comprising:

sending the mobile device classifier to a mobile computing device.

19. The method of claim 18, further comprising:

receiving the mobile device classifier in a device processor of the mobile computing device; and

classifying in the device processor a behavior of the mobile computing device based on the received mobile device classifier.

20. A communication system, comprising:

a server comprising;

means for applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

means for computing an answer ratio for one or more nodes of the boosted decision tree;

means for determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed answer ratios;

means for applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign;

means for generating a mobile device classifier based on the second family of classifier models; and

means for sending the generated mobile device classifier to the mobile device; and

a mobile computing device, comprising;

means for sending behavior vectors to the server;

means for receiving the mobile device classifier from the server; and

means for classifying a behavior of the mobile computing device based on the received mobile device classifier.

21. A communication system, comprising:

a server comprising a server processor configured with server-executable instructions to perform operations comprising;

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an answer ratio for one or more nodes of the boosted decision tree;

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed answer ratios;

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign;

generating a mobile device classifier based on the second family of classifier models; and

sending the generated mobile device classifier to the mobile device; and

a mobile computing device comprising a device processor configured with processor-executable instructions to perform operations comprising;

sending behavior vectors to the server;

receiving the mobile device classifier from the server; and

classifying a behavior of the mobile computing device based on the received mobile device classifier.

22. A server, comprising:

means for applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

means for computing an answer ratio for one or more nodes of the boosted decision tree; and

means for determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed answer ratios.

23. The server of claim 22, wherein further comprising:

means for applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

means for generating a mobile device classifier based on the second family of classifier models.

24. The server of claim 23, wherein further comprising:

means for sending the generated mobile device classifier to a mobile computing device.

25. A server, comprising:

a processor configured with processor-executable instructions to perform operations comprising;

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an answer ratio for one or more nodes of the boosted decision tree; and

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed answer ratios.

26. The server of claim 25, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

generating a mobile device classifier based on the second family of classifier models.

27. The server of claim 26, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

sending the generated mobile device classifier to a mobile computing device.

28. A non-transitory computer readable storage medium having stored thereon server-executable software instructions configured to cause a server processor to perform operations for generating data models in a communication system, comprising:

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an answer ratio for one or more nodes of the boosted decision tree; and

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed answer ratios.

29. The non-transitory computer readable storage medium of claim 28, wherein the stored server-executable software instructions are configured to cause the server processor to perform operations further comprising:

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

generating a mobile device classifier based on the second family of classifier models.

30. The non-transitory computer readable storage medium of claim 29, wherein the stored server-executable software instructions are configured to cause the server processor to perform operations further comprising:

sending the generated mobile device classifier to a mobile computing device.