Methods and systems of using boosted decision stumps and joint feature selection and culling algorithms for the efficient classification of mobile device behaviors
First Claim
1. A method of generating models in a mobile device, comprising:
- receiving in a processor of the mobile device from a server computing device a full classifier model that includes a finite state machine, the finite state machine including information that is suitable for expression as a plurality of boosted decision stumps, each boosted decision stump including a test condition and a weight value;
generating, by the processor of the mobile device, an ordered list of boosted decision stumps by converting the finite state machine included in the received full classifier model into the plurality of boosted decision stumps;
culling, by the processor of the mobile device, the generated ordered list of boosted decision stumps to generate a lean classifier model in the mobile device, the culling comprising;
determining a number of different test conditions to evaluate in the mobile device in order to classify a mobile device behavior without consuming an excessive amount of energy resources of the mobile device;
generating a list of test conditions that includes the determined number of different test conditions by sequentially traversing the generated ordered list of boosted decision stumps and inserting the test condition associated with each sequentially traversed boosted decision stump into the list of test conditions until the list of test conditions includes the determined number of different test conditions; and
generating the lean classifier model to include the boosted decision stumps that test one of a plurality of test conditions included in the generated list of test conditions;
applying, by the processor of the mobile device, a mobile device behavior vector to the generated lean classifier model to generate results; and
using, by the processor of the mobile device, the generated results to classify the mobile device behavior.
2 Assignments
0 Petitions
Accused Products
Abstract
Methods and systems for classifying mobile device behavior include configuring a server use a large corpus of mobile device behaviors to generate a full classifier model that includes a finite state machine suitable for conversion into boosted decision stumps and/or which describes all or many of the features relevant to determining whether a mobile device behavior is benign or contributing to the mobile device'"'"'s degradation over time. A mobile device may receive the full classifier model and use the model to generate a full set of boosted decision stumps from which a more focused or lean classifier model is generated by culling the full set to a subset suitable for efficiently determining whether mobile device behavior are benign. Boosted decision stumps may be culled by selecting all boosted decision stumps that depend upon a limited set of test conditions.
-
Citations
25 Claims
-
1. A method of generating models in a mobile device, comprising:
-
receiving in a processor of the mobile device from a server computing device a full classifier model that includes a finite state machine, the finite state machine including information that is suitable for expression as a plurality of boosted decision stumps, each boosted decision stump including a test condition and a weight value; generating, by the processor of the mobile device, an ordered list of boosted decision stumps by converting the finite state machine included in the received full classifier model into the plurality of boosted decision stumps; culling, by the processor of the mobile device, the generated ordered list of boosted decision stumps to generate a lean classifier model in the mobile device, the culling comprising; determining a number of different test conditions to evaluate in the mobile device in order to classify a mobile device behavior without consuming an excessive amount of energy resources of the mobile device; generating a list of test conditions that includes the determined number of different test conditions by sequentially traversing the generated ordered list of boosted decision stumps and inserting the test condition associated with each sequentially traversed boosted decision stump into the list of test conditions until the list of test conditions includes the determined number of different test conditions; and generating the lean classifier model to include the boosted decision stumps that test one of a plurality of test conditions included in the generated list of test conditions; applying, by the processor of the mobile device, a mobile device behavior vector to the generated lean classifier model to generate results; and using, by the processor of the mobile device, the generated results to classify the mobile device behavior. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A mobile computing device, comprising:
-
a processor configured with processor-executable instructions to perform operations comprising; receiving a full classifier model that includes a finite state machine, the finite state machine including information that is suitable for expression as a plurality of boosted decision stumps, each boosted decision stump including a test condition and a weight value; generating an ordered list of boosted decision stumps by converting the finite state machine included in the received full classifier model into the plurality of boosted decision stumps; culling the generated ordered list of boosted decision stumps to generate a lean classifier model, the culling comprising; determining a number of different test conditions to evaluate in order to classify a mobile device behavior without consuming an excessive amount of energy resources; generating a list of test conditions that includes the determined number of different test conditions by sequentially traversing the generated ordered list of boosted decision stumps and inserting the test condition associated with each sequentially traversed boosted decision stump into the list of test conditions until the list of test conditions includes the determined number of different test conditions; and generating the lean classifier model to include the boosted decision stumps that test one of a plurality of test conditions included in the generated list of test conditions; applying a mobile device behavior vector to the generated lean classifier model to generate results; and using the generated results to classify the mobile device behavior. - View Dependent Claims (11, 12, 13, 14)
-
-
15. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor in a mobile device to perform operations comprising:
-
receiving a full classifier model that includes a finite state machine, the finite state machine including information that is suitable for expression as a plurality of boosted decision stumps, each boosted decision stump including a test condition and a weight value; generating an ordered list of boosted decision stumps by converting the finite state machine included in the received full classifier model into the plurality of boosted decision stumps; culling the generated ordered list of boosted decision stumps to generate a lean classifier model, the culling comprising; determining a number of different test conditions to evaluate in order to classify a mobile device behavior without consuming an excessive amount of energy resources; generating a list of test conditions that includes the determined number of different test conditions by sequentially traversing the generated ordered list of boosted decision stumps and inserting the test condition associated with each sequentially traversed boosted decision stump into the list of test conditions until the list of test conditions includes the determined number of different test conditions; and generating the lean classifier model to include the boosted decision stumps that test one of a plurality of test conditions included in the generated list of test conditions; applying a mobile device behavior vector to the generated lean classifier model to generate results; and using the generated results to classify the mobile device behavior. - View Dependent Claims (16, 17, 18, 19)
-
-
20. A system, comprising:
-
a mobile device comprising a device processor; and a server configured with server-executable instructions to perform operations comprising; receiving a corpus of information on mobile device behaviors; generating, based on the corpus of information, a finite state machine including data that is suitable for conversion into a plurality of boosted decision stumps that each includes a test condition and a weight value; and sending the finite state machine to the mobile device as a full classifier model, wherein the device processor in the mobile device is configured with processor-executable instructions to perform operations comprising; receiving the full classifier model; generating an ordered list of boosted decision stumps by converting the finite state machine included in the received full classifier model into the plurality of boosted decision stumps; culling the generated ordered list of boosted decision stumps to generate a lean classifier model, the culling comprising; determining a number of different test conditions to evaluate in order to classify a mobile device behavior without consuming an excessive amount of energy resources of the mobile device; generating a list of test conditions that includes the determined number of different test conditions by sequentially traversing the generated ordered list of boosted decision stumps and inserting the test condition associated with each sequentially traversed boosted decision stump into the list of test conditions until the list of test conditions includes the determined number of different test conditions; and generating the lean classifier model to include the boosted decision stumps that test one of a plurality of test conditions included in the generated list of test conditions; applying a mobile device behavior vector to the generated lean classifier model to generate results; and using the generated results to classify the mobile device behavior. - View Dependent Claims (21, 22, 23, 24, 25)
-
Specification