Malware and anomaly detection via activity recognition based on sensor data

• US 9,680,854 B2
• Filed: 04/18/2016
• Issued: 06/13/2017
• Est. Priority Date: 11/04/2013
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Jover, Roger P., Murynets, Ilona
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US15/132,219
• Publication Number:
  US 20160234235A1
• Time in Patent Office: 421 Days
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

A system for malware and anomaly detection via activity recognition based on sensor is disclosed. The system may analyze sensor data collected during a selected time period from one or more sensors that are associated with a device. Once the sensor data is analyzed, the system may determine a context of the device when the device is in a connected state. The system may determine the context of the device based on the sensor data collected during the selected time period. The system may also determine if traffic received or transmitted by the device during the connected state is in a white list. Furthermore, the system may transmit an alert if the traffic is determined to not be in the white list or if the context determined for the device indicates that the context does not correlate with the traffic.

Claims

1. A system comprising:

a memory that stores instructions;

a processor that executes the instructions to perform operations, the operations comprising;

analyzing sensor data collected from at least one sensor associated with a device;

determining a context of the device when the device is in a connected state, wherein the context of the device is determined based on the sensor data collected from the at least one sensor, wherein the context of the device comprises an indication as to a speed of the device;

determining whether a source of received traffic or a destination of transmitted traffic by the device during the connected state is in a white list; and

transmitting an alert when the source of the received traffic or the destination of the transmitted traffic is not in the white list and when the context determined for the device indicates that the context does not correlate with the received traffic or the transmitted traffic.

2. The system of claim 1, wherein the operations further comprise:

activating the at least one sensor associated with the device when the device is in the connected state.

3. The system of claim 2, wherein the operations further comprise:

deactivating the at least one sensor when a selected time period has expired.

4. The system of claim 1, wherein the operations further comprise:

assigning the source of the received traffic or the destination of the transmitted traffic to a black list when the source of the received traffic or the destination of the transmitted traffic is determined to not be in the white list.

5. The system of claim 1, wherein the operations further comprise:

providing, with the alert, an option to block an application associated with the received traffic or the transmitted traffic.

6. The system of claim 1, wherein the operations further comprise:

assigning a score to the context determined for the device.

7. The system of claim 6, wherein the operations further comprise:

determining that the context does not correlate with the received traffic or the transmitted traffic when the score for the context is greater than a threshold level.

8. The system of claim 1, wherein the context of the device further comprises an indication of a proximity of the device to an object, an indication of ambient light around the device or an indication of an acceleration of the device.

9. A method comprising:

analyzing, by a processor, sensor data collected from at least one sensor associated with a device;

determining, by the processor, a context of the device when the device is in a connected state, wherein the context of the device is determined based on the sensor data collected from the at least one sensor, wherein the context of the device comprises an indication as to a speed of the device;

determining, by the processor, whether a source of received traffic or a destination of transmitted traffic by the device during the connected state is in a white list; and

transmitting, by the processor, an alert when the source of the received traffic or the destination of the transmitted traffic is not in the white list and when the context determined for the device indicates that the context does not correlate with the received traffic or the transmitted traffic.

10. The method of claim 9, further comprising:

activating the at least one sensor associated with the device when the device is in the connected state.

11. The method of claim 10, further comprising:

deactivating the at least one sensor when a selected time period has expired.

12. The method of claim 9, further comprising:

assigning the source of the received traffic or the destination of the transmitted traffic to a black list when the source of the received traffic or the destination of the transmitted traffic is determined to not be in the white list.

13. The method of claim 9, further comprising:

providing, with the alert, an option to block an application associated with the received traffic or the transmitted traffic.

14. The method of claim 9, further comprising:

assigning a score to the context determined for the device.

15. The method of claim 14, further comprising:

determining that the context does not correlate with the received traffic or the transmitted traffic when the score for the context is greater than a threshold level.

16. The method of claim 9, wherein the context of the device further comprises an indication of a proximity of the device to an object, an indication of ambient light around the device or an indication of an acceleration of the device.

17. A computer-readable device comprising instructions, which when executed by a processor, cause the processor to perform operations comprising:

analyzing sensor data collected from at least one sensor associated with a device;

determining a context of the device when the device is in a connected state, wherein the context of the device is determined based on the sensor data collected from the at least one sensor, wherein the context of the device comprises an indication as to a speed of the device;

determining whether a source of received traffic or a destination of transmitted traffic by the device during the connected state is in a white list; and

transmitting an alert when the source of the received traffic or the destination of the transmitted traffic is not in the white list and when the context determined for the device indicates that the context does not correlate with the received traffic or the transmitted traffic.

18. The computer-readable device of claim 17, wherein the operations further comprise:

activating the at least one sensor associated with the device when the device is in the connected state.

19. The computer-readable device of claim 18, wherein the operations further comprise:

deactivating the at least one sensor when a selected time period has expired.

20. The computer-readable device of claim 17, wherein the operations further comprise:

assigning the source of the received traffic or the destination of the transmitted traffic to a black list when the source of the received traffic or the destination of the transmitted traffic is determined to not be in the white list.