APIs for obtaining device-specific behavior classifier models from the cloud

• US 9,491,187 B2
• Filed: 01/17/2014
• Issued: 11/08/2016
• Est. Priority Date: 02/15/2013
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Sridhara, Vinay, Gupta, Rajarshi
• Primary Examiner(s): Herzog, Madhuri
• Application Number:
  US14/157,606
• Publication Number:
  US 20140237595A1
• Time in Patent Office: 1,026 Days
• Field of Search: 726 22- 25, 713/100, 713187-188
• US Class Current: 1/1
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06N 5/043 Distributed expert systems; Blackboards
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04W 4/00 Services specially adapted for wireless communication networks; Facilities therefor

Abstract

The various aspects provide a system and methods implemented on the system for generating a behavior model on a server that includes features specific to a mobile computing device and the device'"'"'s current state/configuration. In the various aspects, the mobile computing device may send information identifying itself, its features, and its current state to the server. In response, the server may generate a device-specific lean classifier model for the mobile computing device based on the device'"'"'s information and state and may send the device-specific lean classifier model to the device for use in detecting malicious behavior. The various aspects may enhance overall security and performance on the mobile computing device by leveraging the superior computing power and resources of the server to generate a device-specific lean classifier model that enables the device to monitor features that are actually present on the device for malicious behavior.

Claims

1. A method of generating a lean classifier model on a server for use by a mobile computing device in monitoring for malicious behaviors, comprising:

receiving, on the server, information from the mobile computing device identifying at least one capability and a state of the mobile computing device;

obtaining a cloud data set of information collected from a plurality of other mobile computing devices;

generating, on the server, a lean classifier model specific to the mobile computing device, wherein generating the mobile computing device-specific lean classifier model comprises filtering the cloud data set of information based on the at least one capability and the state of the mobile computing device; and

sending, from the server to the mobile computing device, the mobile computing device-specific lean classifier model,

wherein the mobile device-specific lean classifier model comprises a processor-executable information structure configured to enable a system reliability module on the mobile computing device to classify behavior of the mobile computing device, wherein classifying behavior comprises analyzing features specific to the at least one capability and the state of the mobile computing device.

2. The method of claim 1, further comprising:

determining on the server whether there is a stored lean classifier model associated with the at least one capability and the state of the mobile computing device,

wherein;

generating the mobile computing device-specific lean classifier model comprises retrieving the stored lean classifier model in response to determining that there is a stored lean classifier model associated with the at least one capability and the state of the mobile computing device; and

sending the mobile computing device-specific lean classifier model from the server to the mobile computing device comprises sending the stored lean classifier model from the server to the mobile computing device in response to determining that there is a stored classifier model associated with the at least one capability and the state of the mobile computing device.

3. The method of claim 1, wherein generating on the server a mobile computing device-specific lean classifier model further comprises training the cloud data set of information with the information received from the mobile computing device identifying the at least one capability and the state of the mobile computing device.

4. The method of claim 1, further comprising:

storing the lean classifier model in the server;

determining, on the server, whether to update the stored lean classifier model; and

in response to determining to update the stored lean classifier model;

training an updated cloud data set on the server with the information received from the mobile computing device identifying the at least one capability and the state of the mobile computing device to produce an updated lean classifier model; and

sending the updated lean classifier model from the server to the mobile computing device.

5. The method of claim 1, further comprising:

determining, on the mobile computing device, a set of device-specific features associated with the at least one capability of the mobile computing device;

determining, on the mobile computing device, a set of state-specific features associated with the state of the mobile computing device,

generating, on the mobile computing device, the information identifying the at least one capability and the state of the mobile computing device based on the set of device-specific features and the set of state-specific features; and

sending the generated information from the mobile computing device to the server.

6. The method of claim 5, further comprising:

determining, on the mobile computing device, whether a change in functionality on the mobile computing device has been detected;

determining, on the mobile computing device, whether a change in state of the mobile computing device has been detected; and

in response to detecting a change in at least one of functionality and state;

updating the generated information in the mobile computing device;

sending updated information from the mobile computing device to the server; and

receiving, on the mobile computing device, an updated lean classifier model from the server based on the updated information and in response to sending the updated information.

7. The method of claim 5, further comprising receiving, on the mobile computing device, a user input indicating the at least one capability and the state of the mobile computing device, wherein:

determining the set of device-specific features and the set of state-specific features on the mobile computing device is based on the user input.

8. The method of claim 7, wherein receiving, on the mobile computing device, a user input indicating the at least one capability and the state of the mobile computing device comprises receiving on the mobile computing device a user input indicating at least one anticipated capability and an anticipated state of the mobile computing device.

9. A server, comprising:

a processor configured with processor-executable instructions to perform operations comprising;

receiving information from a mobile computing device identifying at least one capability and a state of the mobile computing device;

obtaining a cloud data set of information collected from a plurality of other mobile computing devices;

generating a lean classifier model specific to the mobile computing device, wherein generating the mobile computing device-specific lean classifier model comprises filtering the cloud data set of information based on the at least one capability and the state of the mobile computing device; and

sending the mobile computing device-specific lean classifier model to the mobile computing device,

wherein the mobile computing device-specific lean classifier model comprises a processor-executable information structure configured to enable a system reliability module on the mobile computing device to classify behavior of the mobile computing device, wherein classifying behavior comprises analyzing features that are specific to the at least one capability and the state of the mobile computing device.

10. The server of claim 9, wherein:

the processor is configured with processor-executable instructions to perform operations further comprising determining whether there is a stored lean classifier model associated with the at least one capability and the state of the mobile computing device,

wherein;

the processor is configured with processor-executable instructions such that generating the mobile computing device-specific lean classifier model comprises retrieving the sorted lean classifier model in response to determining that there is a stored lean classifier model associated with the at least one capability and the state of the mobile computing device; and

sending the mobile computing device-specific lean classifier model to the mobile computing device comprises sending the stored lean classifier model to the mobile computing device in response to determining that there is a stored classifier model associated with the at least one capability and the state of the mobile computing device.

11. The server of claim 9, wherein the processor is configured with processor-executable instructions to perform operations such that generating a mobile computing device-specific lean classifier model further comprises training the cloud data set of information with the information received from the mobile computing device identifying the at least one capability and the state of the mobile computing device.

12. The server of claim 9, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

storing the lean classifier model in memory;

determining whether to update the stored lean classifier model; and

in response to determining to update the stored lean classifier model;

training an updated cloud data set with the information received from the mobile computing device identifying the at least one capability and the state of the mobile computing device to produce an updated lean classifier model; and

sending the updated lean classifier model to the mobile computing device.

13. A system, comprising:

a server comprising a server processor; and

a mobile computing device comprising;

a memory;

a transceiver configured to communicate with a network coupled to the server; and

a mobile computing device processor coupled to the memory and the transceiver,

wherein;

the mobile computing device processor is configured with processor-executable instructions to perform operations comprising sending information identifying at least one capability and a state of the mobile computing device to the server; and

the server processor is configured with processor-executable instructions to perform operations comprising;

receiving the information from the mobile computing device identifying the at least one capability and the state of the mobile computing device;

obtaining a cloud data set of information collected from a plurality of other mobile computing devices;

generating a lean classifier model specific to the mobile computing device, wherein generating the mobile computing device-specific lean classifier model comprises filtering the cloud data set of information based on the at least one capability and the state of the mobile computing device; and

sending the mobile computing device-specific lean classifier model to the mobile computing device,

wherein the mobile computing device-specific lean classifier model comprises a processor-executable information structure configured to enable a system reliability module on the mobile computing device to classify behavior of the mobile computing device, wherein classifying behavior comprises analyzing features that are specific to the at least one capability and the state of the mobile computing device.

14. The system of claim 13, wherein:

the server processor is configured with server-executable instructions to perform operations further comprising determining whether there is a stored lean classifier model associated with the at least one capability and the state of the mobile computing device;

the server processor is configured with server-executable instructions such that generating the mobile device-specific lean classifier model comprises retrieving the stored lean classifier model in response to determining that there is a stored lean classifier model associated with the at least one capability and the state of the mobile computing device; and

the server processor is configured with server-executable instructions to perform operations such that sending the mobile computing device-specific lean classifier model to the mobile computing device comprises sending the stored lean classifier model to the mobile computing device in response to determining that there is a stored classifier model associated with the at least one capability and the state of the mobile computing device.

15. The system of claim 13, wherein the server processor is configured with processor-executable instructions to perform operations such that generating a mobile computing device-specific lean classifier model further comprises training the cloud data set of information with the information received from the mobile computing device identifying the at least one capability and the state of the mobile computing device.

16. The system of claim 13, wherein the server processor is configured with processor-executable instructions to perform operations further comprising:

storing the lean classifier model in memory;

determining whether to update the stored lean classifier model; and

in response to determining to update the stored lean classifier model;

training an updated cloud data set with the information received from the mobile computing device identifying the at least one capability and the state of the mobile computing device to produce an updated lean classifier model; and

sending the updated lean classifier model to the mobile computing device.

17. The system of claim 13, wherein the mobile computing device processor is configured with processor-executable instructions to perform operations such that sending information identifying at least one capability and a state of the mobile computing device to the server comprises:

determining a set of device-specific features associated with at least one capability present on the mobile computing device;

determining a set of state-specific features associated with a state of the mobile computing device;

generating the information identifying the at least one capability and the state of the mobile computing device based on the set of device-specific features and the set of state-specific features; and

sending the generated information to the server.

18. The system of claim 17, wherein the mobile computing device processor is configured with processor-executable instructions to perform operations further comprising:

determining whether a change in functionality on the mobile computing device has been detected;

determining whether a change in state of the mobile computing device has been detected; and

in response to detecting a change in at least one of functionality and state;

updating the generated information;

sending updated information to the server; and

receiving an updated lean classifier model from the server based on the updated information and in response to sending the updated information.

19. The system of claim 17, wherein:

the mobile computing device processor is configured with processor-executable instructions to perform operations further comprising receiving a user input indicating the at least one capability and the state of the mobile computing device; and

the mobile computing device processor is configured with processor-executable instructions to perform operations such that;

determining the set of device-specific features and the set of state-specific features on the mobile computing device is based on the user input.

20. The system of claim 19, wherein the mobile computing device processor is configured with processor-executable instructions to perform operations such that receiving a user input indicating the at least one capability and the state of the mobile computing device comprises receiving a user input indicating at least one anticipated capability and an anticipated state of the mobile computing device.