Methods, devices, and systems for communicating behavioral analysis information

• US 9,609,456 B2
• Filed: 07/24/2014
• Issued: 03/28/2017
• Est. Priority Date: 05/14/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Valencia, Andres, Gupta, Rajarshi, Christodorescu, Mihai
• Primary Examiner(s): Barot, Bharat N
• Application Number:
  US14/339,809
• Publication Number:
  US 20140337862A1
• Time in Patent Office: 978 Days
• Field of Search: 709202-203, 709217-219, 455/410, 455/414.3
• US Class Current: 1/1
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: H04M 3/00 Automatic or semi-automatic exchanges
• CPC Class Codes: H04W 4/00 Services specially adapted for wireless communication networks; Facilities therefor

Abstract

Methods, systems and devices for communicating behavior analysis information using an application programming interface (API) may include receiving via the API a request to register the second module to access an operation of a behavioral monitoring system of the mobile computing device, and exchanging authentication information between the first module and the second module to accomplish mutual authentication. Aspects may include receiving via the API a request for version identification information that may be used by the server to determine how to interpret, evaluate, or crowd-source information, and exchanging version identification information between the first module and the second module to cause the second module to send the information to the server. Aspects may further include receiving via the API a provision malware model request including a command causing the first module to send a malware or classifier model to a behavioral monitoring system of the mobile computing device.

Claims

1. A method of communicating information between components of a mobile computing device to communicate with a server, comprising:

receiving, by a mobile device processor of the mobile computing device and in a first component of the mobile computing device, a registration request from a second component of the mobile computing device via an application programming interface (API);

exchanging authentication information between the first component and the second component via the API to accomplish mutual authentication in response to the first component receiving the registration request;

invoking, by the second component, an operation of a behavioral monitoring system of the mobile computing device in response to accomplishing mutual authentication;

collecting, by the first component, behavior information regarding behavior features observed in the mobile computing device in response to the second component invoking the operation of the behavioral monitoring system;

exchanging the collected behavior information between the first component and the second component via the API to cause the second component to send the collected behavior information to the server.

2. The method of claim 1, further comprising:

receiving via the API a request for version identification information that is suitable for use by the server in determining how to interpret, evaluate, or crowd-source information; and

exchanging the version identification information between the first component and the second component to cause the second component to send the version identification information to the server.

3. The method of claim 1, further comprising:

receiving via the API a provision model request that includes a command suitable for causing the first component to send a classifier model to the behavioral monitoring system of the mobile computing device.

4. The method of claim 1, further comprising:

receiving a request observation request for the mobile computing device to monitor or observe a specific mobile computing device behavior; and

exchanging the request observation request between the second component and the first component to cause the mobile computing device to monitor or observe the specific mobile computing device behavior.

5. The method of claim 1, further comprising:

receiving via the API a request to receive information regarding an occurrence of a condition or event; and

exchanging version identification information between the first component and the second component to cause the second component to send specific information regarding the occurrence of the condition or event to the server.

6. The method of claim 1, further comprising:

receiving via the API a request for actuation that includes a command suitable for causing the mobile computing device to uninstall an application, block a process, or terminate the process.

7. The method of claim 1, further comprising:

receiving via the API a request for automatic actuation that includes a command suitable for causing the mobile computing device to define a condition or event that will cause the mobile computing device to perform an actuation operation.

8. The method of claim 7, wherein the actuation operation includes one of uninstalling an application, blocking a process, and terminating the process.

9. A mobile computing device, comprising:

a processor configured with processor-executable instructions to perform operations, comprising;

receiving in a first component of the mobile computing device a registration request from a second component of the mobile computing device via an application programming interface (API);

exchanging authentication information between the first component and the second component via the API to accomplish mutual authentication in response to the first component receiving the registration request;

invoking, by the second component, an operation of a behavioral monitoring system of the mobile computing device in response to accomplishing mutual authentication;

collecting, by the first component, behavior information regarding behavior features observed in the mobile computing device in response to the second component invoking the operation of the behavioral monitoring system;

exchanging the collected behavior information between the first component and the second component via the API to cause the second component to send the collected behavior information to a server.

10. The mobile computing device of claim 9, wherein the processor is further configured with processor-executable instructions to perform operations comprising:

receiving via the API a request for version identification information that is suitable for use by the server in determining how to interpret, evaluate, or crowd-source information; and

exchanging the version identification information between the first component and the second component to cause the second component to send the version identification information to the server.

11. The mobile computing device of claim 9, wherein the processor is further configured with processor-executable instructions to perform operations comprising:

receiving via the API a provision model request that includes a command suitable for causing the first component to send a or classifier model to the behavioral monitoring system of the mobile computing device.

12. The mobile computing device of claim 9, wherein the processor is further configured with processor-executable instructions to perform operations comprising:

receiving a request observation request for the mobile computing device to monitor or observe a specific mobile computing device behavior; and

exchanging the request observation request between the second component and the first component to cause the mobile computing device to monitor or observe the specific mobile computing device behavior.

13. The mobile computing device of claim 9, wherein the processor is further configured with processor-executable instructions to perform operations comprising:

receiving via the API a request to receive information regarding an occurrence of a condition or event; and

exchanging version identification information between the first component and the second component to cause the second component to send specific information regarding the occurrence of the condition or event to the server.

14. The mobile computing device of claim 9, wherein the processor is further configured with processor-executable instructions to perform operations comprising:

receiving via the API a request for actuation that includes a command suitable for causing the mobile computing device to uninstall an application, block a process, or terminate the process.

15. The mobile computing device of claim 9, wherein the processor is further configured with processor-executable instructions to perform operations comprising:

receiving via the API a request for automatic actuation that includes a command suitable for causing the mobile computing device to define a condition or event that will cause the mobile computing device to perform an actuation operation.

16. The mobile computing device of claim 15, wherein the actuation operation includes one of uninstalling an application, blocking a process, and terminating the process.

17. A non-transitory processor-readable storage medium having stored thereon processor-executable instructions to cause a processor of a mobile computing device to perform operations comprising:

receiving in a first component of the mobile computing device a registration request from a second component of the mobile computing device via an application programming interface (API);

exchanging authentication information between the first component and the second component via the API to accomplish mutual authentication in response to the first component receiving the registration request;

invoking, by the second component, an operation of a behavioral monitoring system of the mobile computing device in response to accomplishing mutual authentication;

collecting, by the first component, behavior information regarding behavior features observed in the mobile computing device in response to the second component invoking the operation of the behavioral monitoring system;

exchanging the collected behavior information between the first component and the second component via the API to cause the second component to send the collected behavior information to a server.