System, apparatus, and method for adaptive observation of mobile device behavior

• US 9,898,602 B2
• Filed: 01/29/2015
• Issued: 02/20/2018
• Est. Priority Date: 05/14/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Gupta, Rajarshi, Gathala, Sudha Anil, Halambi, Soorgoli Ashok
• Primary Examiner(s): Gonzales, Vincent
• Application Number:
  US14/609,113
• Publication Number:
  US 20150148109A1
• Time in Patent Office: 1,118 Days
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 52/0251 using monitoring of local events, e.g. events related to user activity
• CPC Class Codes: H04W 52/0258 controlling an operation mode according to history or models of usage information, e.g. activity schedule or time of day
• CPC Class Codes: H04W 88/02 Terminal devices
• CPC Class Codes: Y02D 10/00 Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

Methods, devices and systems for detecting suspicious or performance-degrading mobile device behaviors intelligently, dynamically, and/or adaptively determine computing device behaviors that are to be observed, the number of behaviors that are to be observed, and the level of detail or granularity at which the mobile device behaviors are to be observed. The various aspects efficiently identify suspicious or performance-degrading mobile device behaviors without requiring an excessive amount of processing, memory, or energy resources. Various aspects may correct suspicious or performance-degrading mobile device behaviors. Various aspects may prevent identified suspicious or performance-degrading mobile device behaviors from degrading the performance and power utilization levels of a mobile device over time. Various aspects may restore an aging mobile device to its original performance and power utilization levels.

Claims

1. A method of adaptively observing device behaviors in a computing device, comprising:

computing, via a processor of the computing device, probability values that each indicate a likelihood of a high-level behavior negatively impacting a performance characteristic or a battery consumption level of the computing device over time;

identifying, via the processor, high-level behaviors that have a high probability of negatively impacting the performance characteristic or the battery consumption level of the computing device over time based on a comparison of the computed probability values to a predetermined threshold value;

generating, via the processor, a first behavior vector after the comparison of the computed probability values to the predetermined threshold value, the generated first behavior vector including at least one value for each of the identified high-level behaviors;

using a result of applying the generated first behavior vector to a classifier model to determine a number of lower-level device behaviors that are to be observed in the computing device, select the determined number of lower-level device behaviors for observation, and determine a level of detail for each of the selected lower-level device behaviors; and

observing, via the processor, the determined number of selected lower-level device behaviors at their corresponding determined level of detail to collect behavior information.

2. The method of claim 1, further comprising:

generating, via the processor, a second behavior vector based on the collected behavior information;

applying, via the processor, the generated second behavior vector to the classifier model to generate additional analysis results; and

using, via the processor, the generated additional analysis results to update the determined level of detail.

3. The method of claim 2, wherein using the generated additional analysis results to update the determined level of detail comprises increasing the determined level of detail.

4. The method of claim 3, further comprising:

observing the selected device behaviors at the increased level of detail to collect additional behavior information;

regenerating, via the processor, the second behavior vector based on the collected additional behavior information;

applying, via the processor, the regenerated second behavior vector to the classifier model to generate updated additional analysis results; and

using, via the processor, the updated additional analysis results to determine whether to further increase the level of detail.

5. The method of claim 2, further comprising:

using, via the processor, the generated additional analysis results to determine whether one or more of the selected device behaviors are non-benign.

6. The method of claim 5, wherein using the generated analysis result to determine whether one or more of the device behaviors are non-benign comprises:

generating, via the processor, at least one spatial correlation and at least one temporal correlation based on elements included in the second behavior vector.

7. The method of claim 6, further comprising:

terminating, via the processor, a software application associated with one or more of the selected device behaviors.

8. A computing device, comprising:

a processor configured with processor-executable instructions to perform operations comprising;

computing probability values that each indicate a likelihood of a high-level behavior negatively impacting a performance characteristic or a battery consumption level of the computing device over time;

identifying high-level behaviors that have a high probability of negatively impacting the performance characteristic or the battery consumption level of the computing device over time based on a comparison of the computed probability values to a predetermined threshold value;

generating a first behavior vector after the comparison of the computed probability values to the predetermined threshold value, the generated first behavior vector including at least one value for each of the identified high-level behaviors;

using a result of applying the generated first behavior vector to a classifier model to determine a number of lower-level device behaviors that are to be observed in the computing device, select the determined number of lower-level device behaviors for observation, and determine a level of detail for each of the selected lower-level device behaviors; and

observing the determined number of selected device lower-level behaviors at their corresponding determined level of detail to collect behavior information.

9. The computing device of claim 8, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

generating a second behavior vector based on the collected behavior information;

applying the generated second behavior vector to the classifier model to generate additional analysis results; and

using the generated additional analysis results to update the determined level of detail.

10. The computing device of claim 9, wherein the processor is configured with processor-executable instructions to perform operations such that using the generated additional analysis results to update the determined level of detail comprises increasing the determined level of detail.

11. The computing device of claim 10, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

observing the selected device behaviors at the increased level of detail to collect additional behavior information;

regenerating the second behavior vector based on the collected additional behavior information;

applying the regenerated second behavior vector to the classifier model to generate updated additional analysis results; and

using the updated additional analysis results to determine whether to further increase the level of detail.

12. The computing device of claim 9, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

using the generated additional analysis results to determine whether one or more of the selected device behaviors are non-benign.

13. The computing device of claim 12, wherein the processor is configured with processor-executable instructions to perform operations further comprising generating at least one spatial correlation and at least one temporal correlation based on elements included in the second behavior vector.

14. The computing device of claim 13, further comprising:

terminating a software application associated with one or more of the selected device behaviors.

15. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor of a computing device to perform operations comprising:

computing probability values that each indicate a likelihood of a high-level behavior negatively impacting a performance characteristic or a battery consumption level of the computing device over time;

identifying high-level behaviors that have a high probability of negatively impacting the performance characteristic or the battery consumption level of the computing device over time based on a comparison of the computed probability values to a predetermined threshold value;

generating a first behavior vector after the comparison of the computed probability values to the predetermined threshold value, the generated first behavior vector including at least one value for each of the identified high-level behaviors;

using a result of applying the generated first behavior vector to a classifier model to determine a number of lower-level device behaviors that are to be observed in the computing device, select the determined number of lower-level device behaviors for observation, and determine a level of detail for each of the selected lower-level device behaviors; and

observing the determined number of selected lower-level device behaviors at their corresponding determined level of detail to collect behavior information.

16. The non-transitory computer readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

generating a second behavior vector based on the collected behavior information;

applying the generated second behavior vector to the classifier model to generate additional analysis results; and

using the generated additional analysis results to update the determined level of detail.

17. The non-transitory computer readable storage medium of claim 16, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that using the generated additional analysis results to update the determined level of detail comprises increasing the determined level of detail.

18. The non-transitory computer readable storage medium of claim 17, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

observing the selected device behaviors at the increased level of detail to collect additional behavior information;

regenerating the second behavior vector based on the collected additional behavior information;

applying the regenerated second behavior vector to the classifier model to generate updated additional analysis results; and

using the updated additional analysis results to determine whether to further increase the level of detail.

19. The non-transitory computer readable storage medium of claim 16, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

using the generated additional analysis results to determine whether one or more of the selected device behaviors are non-benign.

20. The non-transitory computer readable storage medium of claim 19, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising generating at least one spatial correlation and at least one temporal correlation based on elements included in the second behavior vector.

21. The non-transitory computer readable storage medium of claim 20, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

terminating a software application associated with one or more of the selected device behaviors.

22. A computing device, comprising:

means for computing probability values that each indicate a likelihood of a high-level behavior negatively impacting a performance characteristic or a battery consumption level of the computing device over time;

means for identifying high-level behaviors that have a high probability of negatively impacting the performance characteristic or the battery consumption level of the computing device over time based on a comparison of the computed probability values to a predetermined threshold value;

means for generating a first behavior vector after the comparison of the computed probability values to the predetermined threshold value, the generated first behavior vector including at least one value for each of the identified high-level behaviors that have the high probability;

means for using a result of applying the generated first behavior vector to a classifier model to determine a number of lower-level device behaviors that are to be observed in the computing device, select the determined number of lower-level device behaviors for observation, and determine a level of detail for each of the selected lower-level device behaviors; and

means for observing the determined number of selected lower-level device behaviors at their corresponding determined level of detail to collect behavior information.

23. The computing device of claim 22, further comprising:

means for generating a second behavior vector based on the collected behavior information;

means for applying the generated second behavior vector to the classifier model to generate additional analysis results; and

means for using the generated additional analysis results to update the determined level of detail.

24. The computing device of claim 23, wherein means for using the generated additional analysis results to update the determined level of detail comprises means for increasing the determined level of detail.

25. The computing device of claim 24, further comprising:

means for observing the selected device behaviors at the increased level of detail to collect additional behavior information;

means for regenerating the second behavior vector based on the collected additional behavior information;

means for applying the regenerated second behavior vector to the classifier model to generate updated additional analysis results; and

means for using the updated additional analysis results to determine whether to further increase the level of detail.

26. The computing device of claim 23, further comprising:

means for using the generated additional analysis results to determine whether one or more of the selected device behaviors are non-benign.