Adaptive observation of behavioral features on a mobile device

• US 9,330,257 B2
• Filed: 06/30/2014
• Issued: 05/03/2016
• Est. Priority Date: 08/15/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Valencia, Andres, Salajegheh, Mastooreh, Sridhara, Vinay, Christodorescu, Mihai, Gupta, Rajarshi
• Primary Examiner(s): Shehni, Ghazal
• Application Number:
  US14/319,471
• Publication Number:
  US 20140317734A1
• Time in Patent Office: 673 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS

Abstract

Methods, devices and systems for detecting suspicious or performance-degrading mobile device behaviors intelligently, dynamically, and/or adaptively determine computing device behaviors that are to be observed, the number of behaviors that are to be observed, and the level of detail or granularity at which the mobile device behaviors are to be observed. The various aspects efficiently identify suspicious or performance-degrading mobile device behaviors without requiring an excessive amount of processing, memory, or energy resources.

Claims

1. A method for behavior tracking in a mobile device using behavioral vectors, the method comprising:

determining in a processor of the mobile device a feature that is to be observed in the mobile device in order to identify a suspicious mobile device behavior,

adaptively observing the determined feature in the mobile device by collecting behavior information from an instrumented component that is associated with the determined feature;

generating a vector data structure that describes the collected behavior information via a plurality of numbers; and

performing behavior analysis operations that include applying a classifier model that includes decision nodes to the vector data structure to identify the suspicious mobile device behavior.

2. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises one of:

monitoring the instrumented component to detect access or use of call history information without prior user interaction;

monitoring the instrumented component to detect the access and use of a proximity sensor;

monitoring access, use, or communication of voicemail information; and

monitoring the instrumented component to identify applications that move to a foreground of an electronic display of the mobile device.

3. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises monitoring universal serial bus (USB) communications.

4. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises monitoring browser-based video, audio, file upload, or camera operations.

5. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises monitoring battery usage levels or patterns.

6. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises one of:

monitoring a software application'"'"'s communication of information after reading a shared data file; and

monitoring the software application'"'"'s communication of information after reading a memory card.

7. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises one of:

monitoring opening or closing of a browser software application; and

monitoring writing or deleting browser information.

8. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises monitoring adding or removing of contacts to a contacts list of the mobile device.

9. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises monitoring the instrumented component to detect a deletion of text or a multimedia message.

10. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises monitoring an access or use of a motion coprocessor.

11. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises monitoring a software application'"'"'s interactions with a power management system.

12. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises monitoring changes in a power state of an electronic display of the mobile device.

13. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises monitoring one or more of usage patterns of a processor, usage patterns of memory, usage patterns of a battery, usage patterns of a sensor, communication patterns, and file access patterns.

14. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises one of

monitoring a pairing with a Bluetooth device;

monitoring near field communication (NFC) multipurpose Internet mail extension (MIME) type objects or communications;

communication via peer-to-peer near NFC links; and

monitoring a sending of an NFC intent.

15. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises one of:

monitoring an installation of a widget in the mobile device;

monitoring an installation of a shortcut in the mobile device;

monitoring communications with a Linux device or virtual file.

16. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises monitoring applications watching for or receiving a boot complete event.

17. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises monitoring the instrumented component to detect display of an invisible widget.

18. The method of claim 1, wherein adaptively observing the determined feature by collecting the behavior information from the instrumented component that is associated with the determined feature comprises monitoring for applications coming into a foreground in combination with displaying a graphical user interface selected from a keyboard, a keypad and a signature block.

19. A mobile computing device, comprising:

a processor configured with processor-executable instructions to perform operations comprising;

determining a feature that is to be observed in the mobile computing device in order to identify a suspicious mobile device behavior, and

adaptively observing the determined feature in the mobile computing device by collecting behavior information from an instrumented component that is associated with the determined feature;

generating a vector data structure that describes the collected behavior information via a plurality of numbers; and

performing behavior analysis operations that include applying a classifier model that includes decision nodes to the vector data structure to identify the suspicious mobile device behavior.

20. A non-transitory processor-readable storage medium having stored thereon processor-executable instructions configured to cause a processor of a mobile computing device to perform operations comprising:

determining a feature that is to be observed in the mobile computing device in order to identify a suspicious mobile device behavior, and

adaptively observing the determined feature in the mobile computing device by collecting behavior information from an instrumented component that is associated with the determined feature;

generating a vector data structure that describes the collected behavior information via a plurality of numbers; and

performing behavior analysis operations that include applying a classifier model that includes decision nodes to the vector data structure to identify the suspicious mobile device behavior.