Device security using user interaction anomaly detection
First Claim
1. A mobile device, comprising:
- one or more processors; and
one or more memory devices that store instructions executable by the one or more processors;
wherein the one or more processors when executing the instructions;
receive first user-interaction information indicative of first sensed interactions of a user with the mobile device during a first period of time;
receive second user-interaction information indicative of second sensed interactions of a user with the mobile device during a second period of time that is subsequent to the first period of time;
compare the second user-interaction information against the first user-interaction information;
report anomaly information to a security service of the mobile device, a remote system, or both, where an amount of anomaly between the first user-interaction information and the second user-interaction information exceeds a likeness threshold, the anomaly information including a difference between the first user-interaction information and the second user-interaction information;
upload preselected types of data stored locally on the mobile device to a secured storage block of the remote system, when the amount of anomaly between the first user-interaction information and the second user-interaction information exceeds the likeness threshold; and
remove the preselected types of data stored locally on the mobile device subsequent to the uploading of the preselected types of data, when the amount of anomaly between the first user-interaction information and the second user-interaction information exceeds the likeness threshold.
1 Assignment
0 Petitions
Accused Products
Abstract
A mobile device security system can include circuitry configured to receive first user-interaction information associated with the mobile device. The first user-interaction information can be indicative of first sensed interactions of a user with the mobile device during a first period of time. The system can also include circuitry configured to receive second user-interaction information associated with the mobile device. The second user-interaction information can be indicative of second sensed interactions of a user with the mobile device during a second period of time that is subsequent to the first period of time. The system can also include circuitry configured to compare the first and second user-interaction information. The system can also include circuitry configured to report anomaly information to a security service of the mobile device and/or a remote system, where a difference between the first and second user-interaction information exceeds a threshold.
23 Citations
17 Claims
-
1. A mobile device, comprising:
-
one or more processors; and one or more memory devices that store instructions executable by the one or more processors; wherein the one or more processors when executing the instructions; receive first user-interaction information indicative of first sensed interactions of a user with the mobile device during a first period of time; receive second user-interaction information indicative of second sensed interactions of a user with the mobile device during a second period of time that is subsequent to the first period of time; compare the second user-interaction information against the first user-interaction information; report anomaly information to a security service of the mobile device, a remote system, or both, where an amount of anomaly between the first user-interaction information and the second user-interaction information exceeds a likeness threshold, the anomaly information including a difference between the first user-interaction information and the second user-interaction information; upload preselected types of data stored locally on the mobile device to a secured storage block of the remote system, when the amount of anomaly between the first user-interaction information and the second user-interaction information exceeds the likeness threshold; and remove the preselected types of data stored locally on the mobile device subsequent to the uploading of the preselected types of data, when the amount of anomaly between the first user-interaction information and the second user-interaction information exceeds the likeness threshold. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A method, comprising:
-
sensing, by at least one sensor of a mobile device, user interactions with the mobile device within a first time period and a second time period that is subsequent to the first time period; determining, by sensed data processing circuitry of the mobile device, first sensed interactions and second sensed interactions according to the sensed user interactions, respectively; receiving, by first data retrieval circuitry of a mobile device, first user-interaction information indicative of the first sensed interactions of a user with the mobile device during the first time period; receiving, by second data retrieval circuitry of the mobile device, second user-interaction information indicative of the second sensed interactions of a user with the mobile device during the second period of time; comparing, by comparison circuitry of the mobile device, the second user-interaction information against the first user-interaction information; when an amount of anomaly between the first user-interaction information and the second user-interaction information exceeds a likeness threshold, reporting, by reporting circuitry of the mobile device, anomaly information to a security service of the mobile device, a remote system, or both, the anomaly information including a difference between the first user-interaction information and the second user-interaction information; uploading, by data backup circuitry of the mobile device, preselected types of data stored locally on the mobile device to a secured storage block of the remote system when the amount of anomaly between the first user-interaction information and the second user-interaction information exceeds the likeness threshold; and removing, by data removal circuitry of the mobile device, the preselected types of data stored locally on the mobile device subsequent to the uploading of the preselected types of data when the amount of anomaly between the first user-interaction information and the second user-interaction information exceeds the likeness threshold. - View Dependent Claims (9, 10, 11, 12, 13)
-
-
14. A non-transitory computer readable medium, comprising:
-
instructions executable by a processor to receive first user-interaction information indicative of first sensed interactions of a user with a mobile device during a first period of time; instructions executable by a processor to receive second user-interaction information indicative of second sensed interactions of a user with the mobile device during a second period of time that is subsequent to the first period of time; instructions executable by a processor to compare the second user-interaction information against the first user-interaction information; instructions executable by a processor to report anomaly information to a security service of the mobile device, a remote system, or both, where an amount of anomaly between the first user-interaction information and the second user-interaction information exceeds a likeness threshold, the anomaly information including a difference between the first user-interaction information and the second user-interaction information; instructions executable by a processor to upload preselected types of data stored locally on the mobile device to a secured storage block of the remote system, when the amount of anomaly between the first user-interaction information and the second user-interaction information exceeds the likeness threshold; and instructions executable by a processor to remove the preselected types of data stored locally on the mobile device subsequent to the uploading of the preselected types of data, when the amount of anomaly between the first user-interaction information and the second user-interaction information exceeds the likeness threshold. - View Dependent Claims (15, 16, 17)
-
Specification