Adaptive Observation of Behavioral Features on a Mobile Device

• US 20140053260A1
• Filed: 06/21/2013
• Published: 02/20/2014
• Est. Priority Date: 08/15/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Gupta, Rajarshi, Sridhara, Vinay, Gathala, Anil, Wei, Xuetao
• Granted Patent: US 9,495,537 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

Methods, devices and systems for detecting suspicious or performance-degrading mobile device behaviors intelligently, dynamically, and/or adaptively determine computing device behaviors that are to be observed, the number of behaviors that are to be observed, and the level of detail or granularity at which the mobile device behaviors are to be observed. The various aspects efficiently identify suspicious or performance-degrading mobile device behaviors without requiring an excessive amount of processing, memory, or energy resources.

Claims

1. A method for observing mobile device behaviors over a period of time to recognize mobile device behaviors inconsistent with normal operation patterns, the method comprising:

dynamically selecting for observation one or more mobile device behaviors from the group mobile device operations, mobile device events, data network activity, system resource usage, mobile device state, inter-process communications, driver statistics, hardware component status, hardware counters, actions or operations of software applications;

software downloads, changes to device or component settings, conditions and events at an application level, conditions and events at the radio level, and conditions and events at a sensor level; and

adaptively observing the mobile device behaviors to identify a suspicious mobile device behavior from a limited set of observations.

2. The method of claim 1, wherein mobile device operations includes one or more of library application programming interface (API) calls in an application framework or run-time library, system call APIs, file-system and networking sub-system operations, file system activity, searches for filenames, categories of file accesses, creating files, deleting files, file read/write/seek operations, and changing file permissions.

3. The method of claim 1, wherein mobile device events includes one or more of device state changes and sensor devices state changes.

4. The method of claim 1, wherein data network activity includes one or more of types of connections, protocols, port numbers, server/client that the device is connected to, the number of connections, volume or frequency of communications, phone network activity, type and number of calls/messages sent, type and number of calls/messages received, type and number of calls/messages intercepted, call information, text messaging information, media messaging, user account information, transmissions, voicemail, and device identifiers.

5. The method of claim 1, wherein system resource usage includes one or more of monitoring the number of forks, memory access operations, and the number of files open.

6. The method of claim 1, wherein mobile device state includes one or more of display on/off state, locked/unlocked state, battery charge state, camera state, and microphone state.

7. The method of claim 1, wherein inter-process communications includes one or more of monitoring intents to crucial services, monitoring a degree of inter-process communications, and monitoring pop-up windows.

8. The method of claim 1, wherein driver statistics includes statistics from drivers for one or more of cameras, sensors, electronic displays, WiFi communication components, data controllers, memory controllers, system controllers, access ports, peripheral devices, wireless communication components, and external memory chips.

9. The method of claim 1, wherein hardware component status includes one or more of cameras, sensors, electronic displays, WiFi communication components, data controllers, memory controllers, system controllers, access ports, timers, peripheral devices, wireless communication components, external memory chips, voltage regulators, oscillators, phase-locked loops, peripheral bridges, and other similar components used to support the processors and clients running on the mobile computing device.

10. The method of claim 1, wherein hardware counters includes one or more of hardware counters that denote the state or status of the mobile computing device and/or mobile device sub-systems, and special-purpose registers of processors/cores that are configured to store a count or state of hardware-related activities or events.

11. The method of claim 1, wherein actions or operations of software applications includes monitoring of information used by software applications including one or more of location information, camera information, accelerometer information, browser information, content of browser-based communications, content of voice-based communications, short range radio communications, content of text-based communications, content of recorded audio files, phonebook or contact information, contacts lists, calendar information, location information, recorded audio information, accelerometer information, notifications communicated to and from a software application, user verifications, and a user password.

12. The method of claim 1, wherein software downloads includes one or more of software downloads from an application download server, and a first software application requesting the downloading and/or install of a second software application.

13. The method of claim 1, wherein changes to device or component settings includes changes to one or more of compass information, mobile device settings, battery life, gyroscope information, pressure sensors, and screen activity.

14. The method of claim 1, wherein conditions and events at the application level includes one or more of observing user via facial recognition software, observing social streams, observing notes entered by the user, observing event pertaining to use of an electronic payment service, observing events relating to use of virtual private networks, synchronization, voice searches, voice control, language translators, offloading of data for computations, video streaming, camera usage without user activity, and microphone usage without user activity.

15. The method of claim 1, wherein conditions and events at the radio level includes determining the presence, existence or amount of any or all of:

user interaction with the mobile device before establishing radio communication links or transmitting information, multiple subscriber identity module cards, Internet radio, mobile phone tethering, offloading data for computations, device state communications, the use as a game controller or home controller, vehicle communications, mobile device synchronization, monitoring the use of radios for positioning, peer-to-peer communications, synchronization, vehicle to vehicle communications, and/or machine-to-machine, and monitoring network traffic usage, statistics, or profiles.

16. The method of claim 1, wherein conditions and events at the events at the sensor level includes of one or more of monitoring magnet sensors, detecting near-field communications, collecting information from a credit card scanner, barcode scanner, or mobile tag reader, detecting the presence of universal serial bus (USB) power charging source, detecting that a keyboard or auxiliary device has been coupled to the mobile device, detecting that the mobile device has been coupled to a computing device, determining whether a light emitting diode, flash, flashlight, or light source has been modified or disabled, determining whether a speaker or microphone has been turned on or powered, detecting a charging or power event, detecting that the mobile device is being used as a game controller, collecting information from medical purpose/healthcare sensors or from scanning the user'"'"'s body, collecting information from an external sensor plugged into one of a USB port and an audio jack, collecting information from a tactile or haptic sensor, and collecting information pertaining to a thermal state of the mobile device.

17. The method of claim 1, wherein dynamically selecting for observation one or more mobile device behaviors comprises:

observing mobile device behaviors over the period of time; and

identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed.

18. The method of claim 17, wherein identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed comprises:

receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface (API) after filtering by an adaptive filter;

receiving context information regarding operations of the mobile device;

performing spatial correlations of the received behavior inputs and the received context input; and

generating a behavior vector.

19. The method of claim 18, wherein generating a behavior vector comprises:

generating a vector data structure that succinctly describes the observed mobile device behaviors.

20. The method of claim 18, wherein generating a behavior vector comprises:

generating a vector that includes information collected from APIs at various levels/modules of the mobile device.

21. The method of claim 18, wherein generating a behavior vector comprises generating a vector that includes information pertaining to one or more of:

library API calls;

system calls;

file-system and networking sub-system operations;

sensor device state changes;

file system activity;

network activity;

telephone activity;

memory access operations;

a state of the mobile device;

a power on/off state of an electronic display of the mobile device;

a locked/unlocked state the mobile device;

an amount of battery power remaining;

inter-process communications (IPC);

driver statistics; and

hardware counters.

22. The method of claim 18, wherein generating a behavior vector comprises:

generating a vector data structure that includes series of numbers, each of which signifies a feature or a behavior of the mobile device.

23. The method of claim 22, wherein at least one of the series of numbers identifies one or more of:

whether a camera of the mobile device is in use or not in use;

how much network traffic has been generated by the mobile device; and

how many interne messages have been sent from the mobile device.

24. The method of claim 18, wherein generating a behavior vector comprises generating a vector that includes at least one of:

call information;

text messaging information;

media messaging information;

user account information;

location information;

camera information;

accelerometer information; and

browser information.

25. The method of claim 18, wherein generating a behavior vector comprises generating a vector that includes information collected at an application level of the mobile device.

26. The method of claim 18, wherein generating a behavior vector comprises generating a vector that includes information collected at a radio level of the mobile device.

27. The method of claim 18, wherein generating a behavior vector comprises generating a vector that includes information collected at a sensor level of the mobile device.

28. The method of claim 18, wherein identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed further comprises:

performing temporal correlations of the received behavior inputs and the received context input, wherein generating a behavior vector comprises generating a behavior vector based on a result of the spatial and temporal correlations.

29. A computing device, comprising a multi-core processor including two or more processor cores, one or more of which is configured with processor-executable instructions to perform operations comprising:

dynamically selecting for observation one or more mobile device behaviors from the group mobile device operations, mobile device events, data network activity, system resource usage, mobile device state, inter-process communications, driver statistics, hardware component status, hardware counters, actions or operations of software applications;

software downloads, changes to device or component settings, conditions and events at an application level, conditions and events at the radio level, and conditions and events at a sensor level; and

adaptively observing the mobile device behaviors to identify a suspicious mobile device behavior from a limited set of observations.

30. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that mobile device operations includes one or more of library application programming interface (API) calls in an application framework or run-time library, system call APIs, file-system and networking sub-system operations, file system activity, searches for filenames, categories of file accesses, creating files, deleting files, file read/write/seek operations, and changing file permissions.

31. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that mobile device events includes one or more of device state changes and sensor devices state changes.

32. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that data network activity includes one or more of types of connections, protocols, port numbers, server/client that the device is connected to, the number of connections, volume or frequency of communications, phone network activity, type and number of calls/messages sent, type and number of calls/messages received, type and number of calls/messages intercepted, call information, text messaging information, media messaging, user account information, transmissions, voicemail, and device identifiers.

33. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that system resource usage includes one or more of monitoring the number of forks, memory access operations, and the number of files open.

34. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that mobile device state includes one or more of display on/off state, locked/unlocked state, battery charge state, camera state, and microphone state.

35. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that inter-process communications includes one or more of monitoring intents to crucial services, monitoring the degree of inter-process communications, and monitoring pop-up windows.

36. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that driver statistics includes statistics from drivers for one or more of cameras, sensors, electronic displays, WiFi communication components, data controllers, memory controllers, system controllers, access ports, peripheral devices, wireless communication components, and external memory chips.

37. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that hardware component status includes one or more of cameras, sensors, electronic displays, WiFi communication components, data controllers, memory controllers, system controllers, access ports, timers, peripheral devices, wireless communication components, external memory chips, voltage regulators, oscillators, phase-locked loops, peripheral bridges, and other similar components used to support the processors and clients running on the mobile computing device.

38. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that hardware counters includes one or more of hardware counters that denote the state or status of the mobile computing device and/or mobile device sub-systems, and special-purpose registers of processors/cores that are configured to store a count or state of hardware-related activities or events.

39. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that actions or operations of software applications includes monitoring of information used by software applications including one or more of location information, camera information, accelerometer information, browser information, content of browser-based communications, content of voice-based communications, short range radio communications, content of text-based communications, content of recorded audio files, phonebook or contact information, contacts lists, calendar information, location information, recorded audio information, accelerometer information, notifications communicated to and from a software application, user verifications, and a user password.

40. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that software downloads includes one or more of software downloads from an application download server, and a first software application requesting the downloading and/or install of a second software application.

41. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that changes to device or component settings includes changes to one or more of compass information, mobile device settings, battery life, gyroscope information, pressure sensors, and screen activity.

42. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that conditions and events at the application level includes one or more of observing user via facial recognition software, observing social streams, observing notes entered by the user, observing event pertaining to use of an electronic payment service, observing events relating to use of virtual private networks, synchronization, voice searches, voice control, language translators, offloading of data for computations, video streaming, camera usage without user activity, and microphone usage without user activity.

43. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that conditions and events at the radio level includes determining the presence, existence or amount of any or all of:

user interaction with the mobile device before establishing radio communication links or transmitting information, multiple subscriber identity module cards, Internet radio, mobile phone tethering, offloading data for computations, device state communications, the use as a game controller or home controller, vehicle communications, mobile device synchronization, monitoring the use of radios for positioning, peer-to-peer communications, synchronization, vehicle to vehicle communications, and/or machine-to-machine, and monitoring network traffic usage, statistics, or profiles.

44. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that conditions and events at the events at the sensor level includes of one or more of monitoring magnet sensors, detecting near-field communications, collecting information from a credit card scanner, barcode scanner, or mobile tag reader, detecting the presence of universal serial bus (USB) power charging source, detecting that a keyboard or auxiliary device has been coupled to the mobile device, detecting that the mobile device has been coupled to a computing device, determining whether a light emitting diode, flash, flashlight, or light source has been modified or disabled, determining whether a speaker or microphone has been turned on or powered, detecting a charging or power event, detecting that the mobile device is being used as a game controller, collecting information from medical purpose/healthcare sensors or from scanning the user'"'"'s body, collecting information from an external sensor plugged into one of a USB port and an audio jack, collecting information from a tactile or haptic sensor, and collecting information pertaining to a thermal state of the mobile device.

45. The computing device of claim 29, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that dynamically selecting for observation one or more mobile device behaviors comprises:

observing mobile device behaviors over the period of time; and

identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed.

46. The computing device of claim 45, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed comprises:

receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface (API) after filtering by an adaptive filter;

receiving context information regarding operations of the mobile device;

performing spatial correlations of the received behavior inputs and the received context input; and

generating a behavior vector.

47. The computing device of claim 46, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that generating a behavior vector comprises:

generating a vector data structure that succinctly describes the observed mobile device behaviors.

48. The computing device of claim 46, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that generating a behavior vector comprises:

generating a vector that includes information collected from APIs at various levels/modules of the mobile device.

49. The computing device of claim 46, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that generating a behavior vector comprises generating a vector that includes information pertaining to one or more of:

library API calls;

system calls;

file-system and networking sub-system operations;

sensor device state changes;

file system activity;

network activity;

telephone activity;

memory access operations;

a state of the mobile device;

a power on/off state of an electronic display of the mobile device;

a locked/unlocked state the mobile device;

an amount of battery power remaining;

inter-process communications (IPC);

driver statistics; and

hardware counters.

50. The computing device of claim 46, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that generating a behavior vector comprises:

generating a vector data structure that includes series of numbers, each of which signifies a feature or a behavior of the mobile device.

51. The computing device of claim 46, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that at least one of the series of numbers identifies one or more of:

whether a camera of the mobile device is in use or not in use;

how much network traffic has been generated by the mobile device; and

how many internet messages have been sent from the mobile device.

52. The computing device of claim 46, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that generating a behavior vector comprises generating a vector that includes at least one of:

call information;

text messaging information;

media messaging information;

user account information;

location information;

camera information;

accelerometer information; and

browser information.

53. The computing device of claim 46, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that generating a behavior vector comprises generating a vector that includes information collected at an application level of the mobile device.

54. The computing device of claim 46, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that generating a behavior vector comprises generating a vector that includes information collected at a radio level of the mobile device.

55. The computing device of claim 46, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that generating a behavior vector comprises generating a vector that includes information collected at a sensor level of the mobile device.

56. The computing device of claim 46, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations such that identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed further comprises:

performing temporal correlations of the received behavior inputs and the received context input, wherein generating a behavior vector comprises generating a behavior vector based on a result of the spatial and temporal correlations.

57. A computing device, comprising:

means for dynamically selecting for observation one or more mobile device behaviors from the group mobile device operations, mobile device events, data network activity, system resource usage, mobile device state, inter-process communications, driver statistics, hardware component status, hardware counters, actions or operations of software applications;

software downloads, changes to device or component settings, conditions and events at an application level, conditions and events at the radio level, and conditions and events at a sensor level; and

means for adaptively observing the mobile device behaviors to identify a suspicious mobile device behavior from a limited set of observations.

58. The computing device of claim 57, wherein mobile device operations includes one or more of library application programming interface (API) calls in an application framework or run-time library, system call APIs, file-system and networking sub-system operations, file system activity, searches for filenames, categories of file accesses, creating files, deleting files, file read/write/seek operations, and changing file permissions.

59. The computing device of claim 57, wherein mobile device events includes one or more of device state changes and sensor devices state changes.

60. The computing device of claim 57, wherein data network activity includes one or more of types of connections, protocols, port numbers, server/client that the device is connected to, the number of connections, volume or frequency of communications, phone network activity, type and number of calls/messages sent, type and number of calls/messages received, type and number of calls/messages intercepted, call information, text messaging information, media messaging, user account information, transmissions, voicemail, and device identifiers.

61. The computing device of claim 57, wherein system resource usage includes one or more of monitoring the number of forks, memory access operations, and the number of files open.

62. The computing device of claim 57, wherein mobile device state includes one or more of display on/off state, locked/unlocked state, battery charge state, camera state, and microphone state.

63. The computing device of claim 57, wherein inter-process communications includes one or more of monitoring intents to crucial services, monitoring the degree of inter-process communications, and monitoring pop-up windows.

64. The computing device of claim 57, wherein driver statistics includes statistics from drivers for one or more of cameras, sensors, electronic displays, WiFi communication components, data controllers, memory controllers, system controllers, access ports, peripheral devices, wireless communication components, and external memory chips.

65. The computing device of claim 57, wherein hardware component status includes one or more of cameras, sensors, electronic displays, WiFi communication components, data controllers, memory controllers, system controllers, access ports, timers, peripheral devices, wireless communication components, external memory chips, voltage regulators, oscillators, phase-locked loops, peripheral bridges, and other similar components used to support the processors and clients running on the mobile computing device.

66. The computing device of claim 57, wherein hardware counters includes one or more of hardware counters that denote the state or status of the mobile computing device and/or mobile device sub-systems, and special-purpose registers of processors/cores that are configured to store a count or state of hardware-related activities or events.

67. The computing device of claim 57, wherein actions or operations of software applications includes monitoring of information used by software applications including one or more of location information, camera information, accelerometer information, browser information, content of browser-based communications, content of voice-based communications, short range radio communications, content of text-based communications, content of recorded audio files, phonebook or contact information, contacts lists, calendar information, location information, recorded audio information, accelerometer information, notifications communicated to and from a software application, user verifications, and a user password.

68. The computing device of claim 57, wherein software downloads includes one or more of software downloads from an application download server, and a first software application requesting the downloading and/or install of a second software application.

69. The computing device of claim 57, wherein changes to device or component settings includes changes to one or more of compass information, mobile device settings, battery life, gyroscope information, pressure sensors, and screen activity.

70. The computing device of claim 57, wherein conditions and events at the application level includes one or more of observing user via facial recognition software, observing social streams, observing notes entered by the user, observing event pertaining to use of an electronic payment service, observing events relating to use of virtual private networks, synchronization, voice searches, voice control, language translators, offloading of data for computations, video streaming, camera usage without user activity, and microphone usage without user activity.

71. The computing device of claim 57, wherein conditions and events at the radio level includes determining the presence, existence or amount of any or all of:

user interaction with the mobile device before establishing radio communication links or transmitting information, multiple subscriber identity module cards, Internet radio, mobile phone tethering, offloading data for computations, device state communications, the use as a game controller or home controller, vehicle communications, mobile device synchronization, monitoring the use of radios for positioning, peer-to-peer communications, synchronization, vehicle to vehicle communications, and/or machine-to-machine, and monitoring network traffic usage, statistics, or profiles.

72. The computing device of claim 57, wherein conditions and events at the events at the sensor level includes of one or more of monitoring magnet sensors, detecting near-field communications, collecting information from a credit card scanner, barcode scanner, or mobile tag reader, detecting the presence of universal serial bus (USB) power charging source, detecting that a keyboard or auxiliary device has been coupled to the mobile device, detecting that the mobile device has been coupled to a computing device, determining whether a light emitting diode, flash, flashlight, or light source has been modified or disabled, determining whether a speaker or microphone has been turned on or powered, detecting a charging or power event, detecting that the mobile device is being used as a game controller, collecting information from medical purpose/healthcare sensors or from scanning the user'"'"'s body, collecting information from an external sensor plugged into one of a USB port and an audio jack, collecting information from a tactile or haptic sensor, and collecting information pertaining to a thermal state of the mobile device.

73. The computing device of claim 57, wherein means for dynamically selecting for observation one or more mobile device behaviors comprises:

means for observing mobile device behaviors over the period of time; and

means for identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed.

74. The computing device of claim 73, wherein means for identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed comprises:

means for receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface (API) after filtering by an adaptive filter;

means for receiving context information regarding operations of the mobile device;

means for performing spatial correlations of the received behavior inputs and the received context input; and

means for generating a behavior vector.

75. The computing device of claim 74, wherein means for generating a behavior vector comprises:

means for generating a vector data structure that succinctly describes the observed mobile device behaviors.

76. The computing device of claim 74, wherein means for generating a behavior vector comprises:

means for generating a vector that includes information collected from APIs at various levels/modules of the mobile device.

77. The computing device of claim 74, wherein means for generating a behavior vector comprises means for generating a vector that includes information pertaining to one or more of:

library API calls;

system calls;

file-system and networking sub-system operations;

sensor device state changes;

file system activity;

network activity;

telephone activity;

memory access operations;

a state of the mobile device;

a power on/off state of an electronic display of the mobile device;

a locked/unlocked state the mobile device;

an amount of battery power remaining;

inter-process communications (IPC);

driver statistics; and

hardware counters.

78. The computing device of claim 74, wherein means for generating a behavior vector comprises:

means for generating a vector data structure that includes series of numbers, each of which signifies a feature or a behavior of the mobile device.

79. The computing device of claim 78, wherein at least one of the series of numbers identifies one or more of:

whether a camera of the mobile device is in use or not in use;

how much network traffic has been generated by the mobile device; and

how many internet messages have been sent from the mobile device.

80. The computing device of claim 74, wherein means for generating a behavior vector comprises means for generating a vector that includes at least one of:

call information;

text messaging information;

media messaging information;

user account information;

location information;

camera information;

accelerometer information; and

browser information.

81. The computing device of claim 74, wherein means for generating a behavior vector comprises means for generating a vector that includes information collected at an application level of the mobile device.

82. The computing device of claim 74, wherein means for generating a behavior vector comprises means for generating a vector that includes information collected at a radio level of the mobile device.

83. The computing device of claim 74, wherein means for generating a behavior vector comprises means for generating a vector that includes information collected at a sensor level of the mobile device.

84. The computing device of claim 74, wherein means for identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed further comprises:

means for performing temporal correlations of the received behavior inputs and the received context input, wherein generating a behavior vector comprises generating a behavior vector based on a result of the spatial and temporal correlations.

85. A non-transitory processor-readable storage medium having stored thereon processor-executable instructions configured to cause a processor to perform operations comprising:

dynamically selecting for observation one or more mobile device behaviors from the group mobile device operations, mobile device events, data network activity, system resource usage, mobile device state, inter-process communications, driver statistics, hardware component status, hardware counters, actions or operations of software applications;

software downloads, changes to device or component settings, conditions and events at an application level, conditions and events at the radio level, and conditions and events at a sensor level;

at a sensor level; and

adaptively observing the mobile device behaviors to identify a suspicious mobile device behavior from a limited set of observations.

86. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that mobile device operations includes one or more of library application programming interface (API) calls in an application framework or run-time library, system call APIs, file-system and networking sub-system operations, file system activity, searches for filenames, categories of file accesses, creating files, deleting files, file read/write/seek operations, and changing file permissions.

87. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that mobile device events includes one or more of device state changes and sensor devices state changes.

88. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that data network activity includes one or more of types of connections, protocols, port numbers, server/client that the device is connected to, the number of connections, volume or frequency of communications, phone network activity, type and number of calls/messages sent, type and number of calls/messages received, type and number of calls/messages intercepted, call information, text messaging information, media messaging, user account information, transmissions, voicemail, and device identifiers.

89. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that system resource usage includes one or more of monitoring the number of forks, memory access operations, and the number of files open.

90. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that mobile device state includes one or more of display on/off state, locked/unlocked state, battery charge state, camera state, and microphone state.

91. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that inter-process communications includes one or more of monitoring intents to crucial services, monitoring the degree of inter-process communications, and monitoring pop-up windows.

92. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that driver statistics includes statistics from drivers for one or more of cameras, sensors, electronic displays, WiFi communication components, data controllers, memory controllers, system controllers, access ports, peripheral devices, wireless communication components, and external memory chips.

93. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that hardware component status includes one or more of cameras, sensors, electronic displays, WiFi communication components, data controllers, memory controllers, system controllers, access ports, timers, peripheral devices, wireless communication components, external memory chips, voltage regulators, oscillators, phase-locked loops, peripheral bridges, and other similar components used to support the processors and clients running on the mobile computing device.

94. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that hardware counters includes one or more of hardware counters that denote the state or status of the mobile computing device and/or mobile device sub-systems, and special-purpose registers of processors/cores that are configured to store a count or state of hardware-related activities or events.

95. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that actions or operations of software applications includes monitoring of information used by software applications including one or more of location information, camera information, accelerometer information, browser information, content of browser-based communications, content of voice-based communications, short range radio communications, content of text-based communications, content of recorded audio files, phonebook or contact information, contacts lists, calendar information, location information, recorded audio information, accelerometer information, notifications communicated to and from a software application, user verifications, and a user password.

96. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that software downloads includes one or more of software downloads from an application download server, and a first software application requesting the downloading and/or install of a second software application.

97. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that changes to device or component settings includes changes to one or more of compass information, mobile device settings, battery life, gyroscope information, pressure sensors, and screen activity.

98. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that conditions and events at the application level includes one or more of observing user via facial recognition software, observing social streams, observing notes entered by the user, observing event pertaining to use of an electronic payment service, observing events relating to use of virtual private networks, synchronization, voice searches, voice control, language translators, offloading of data for computations, video streaming, camera usage without user activity, and microphone usage without user activity.

99. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that conditions and events at the radio level includes determining the presence, existence or amount of any or all of:

user interaction with the mobile device before establishing radio communication links or transmitting information, multiple subscriber identity module cards, Internet radio, mobile phone tethering, offloading data for computations, device state communications, the use as a game controller or home controller, vehicle communications, mobile device synchronization, monitoring the use of radios for positioning, peer-to-peer communications, synchronization, vehicle to vehicle communications, and/or machine-to-machine, and monitoring network traffic usage, statistics, or profiles.

100. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that conditions and events at the events at the sensor level includes of one or more of monitoring magnet sensors, detecting near-field communications, collecting information from a credit card scanner, barcode scanner, or mobile tag reader, detecting the presence of universal serial bus (USB) power charging source, detecting that a keyboard or auxiliary device has been coupled to the mobile device, detecting that the mobile device has been coupled to a computing device, determining whether a light emitting diode, flash, flashlight, or light source has been modified or disabled, determining whether a speaker or microphone has been turned on or powered, detecting a charging or power event, detecting that the mobile device is being used as a game controller, collecting information from medical purpose/healthcare sensors or from scanning the user'"'"'s body, collecting information from an external sensor plugged into one of a USB port and an audio jack, collecting information from a tactile or haptic sensor, and collecting information pertaining to a thermal state of the mobile device.

101. The non-transitory processor-readable storage medium of claim 85, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that dynamically selecting for observation one or more mobile device behaviors comprises:

observing mobile device behaviors over the period of time; and

identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed.

102. The non-transitory processor-readable storage medium of claim 101, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed comprises:

receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface (API) after filtering by an adaptive filter;

receiving context information regarding operations of the mobile device;

performing spatial correlations of the received behavior inputs and the received context input; and

generating a behavior vector.

103. The non-transitory processor-readable storage medium of claim 102, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that generating a behavior vector comprises:

generating a vector data structure that succinctly describes the observed mobile device behaviors.

104. The non-transitory processor-readable storage medium of claim 102, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that generating a behavior vector comprises:

generating a vector that includes information collected from APIs at various levels/modules of the mobile device.

105. The non-transitory processor-readable storage medium of claim 102, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that generating a behavior vector comprises generating a vector that includes information pertaining to one or more of:

library API calls;

system calls;

file-system and networking sub-system operations;

sensor device state changes;

file system activity;

network activity;

telephone activity;

memory access operations;

a state of the mobile device;

a power on/off state of an electronic display of the mobile device;

a locked/unlocked state the mobile device;

an amount of battery power remaining;

inter-process communications (IPC);

driver statistics; and

hardware counters.

106. The non-transitory processor-readable storage medium of claim 102, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that generating a behavior vector comprises:

generating a vector data structure that includes series of numbers, each of which signifies a feature or a behavior of the mobile device.

107. The non-transitory processor-readable storage medium of claim 106, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that at least one of the series of numbers identifies one or more of:

whether a camera of the mobile device is in use or not in use;

how much network traffic has been generated by the mobile device; and

how many internet messages have been sent from the mobile device.

108. The non-transitory processor-readable storage medium of claim 102, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that generating a behavior vector comprises generating a vector that includes at least one of:

call information;

text messaging information;

media messaging information;

user account information;

location information;

camera information;

accelerometer information; and

browser information.

109. The non-transitory processor-readable storage medium of claim 102, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that generating a behavior vector comprises generating a vector that includes information collected at an application level of the mobile device.

110. The non-transitory processor-readable storage medium of claim 102, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that generating a behavior vector comprises generating a vector that includes information collected at a radio level of the mobile device.

111. The non-transitory processor-readable storage medium of claim 102, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that generating a behavior vector comprises generating a vector that includes information collected at a sensor level of the mobile device.

112. The non-transitory processor-readable storage medium of claim 102, wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that identifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed further comprises:

performing temporal correlations of the received behavior inputs and the received context input, wherein generating a behavior vector comprises generating a behavior vector based on a result of the spatial and temporal correlations.

113. A method of improving performance on a mobile device, comprising:

performing on a mobile device processor real-time behavior analysis of one or more mobile device behaviors to generate coarse observations;

identifying suspicious behavior from the coarse observations;

dynamically determining the mobile device behaviors that require further observation in greater detail;

dynamically determining a level of detail required for the further observation;

performing finer observations based on the determined level of detail required for the further observation; and

identifying suspicious behavior from the finer observations.

114. The method of claim 113, further comprising:

performing mobile devices operations to correct the identified suspicious behavior.

115. A computing device, comprising a multi-core processor including two or more processor cores, one or more of which is configured with processor-executable instructions to perform operations comprising:

performing on a mobile device processor real-time behavior analysis of one or more mobile device behaviors to generate coarse observations;

identifying suspicious behavior from the coarse observations;

dynamically determining the mobile device behaviors that require further observation in greater detail;

dynamically determining a level of detail required for the further observation;

performing finer observations based on the determined level of detail required for the further observation; and

identifying suspicious behavior from the finer observations.

116. The computing device of claim 115, wherein one or more of the processor cores is configured with processor-executable instructions to perform operations further comprising:

performing mobile devices operations to correct the identified suspicious behavior.

117. A computing device, comprising:

means for performing on a mobile device processor real-time behavior analysis of one or more mobile device behaviors to generate coarse observations;

means for identifying suspicious behavior from the coarse observations;

means for dynamically determining the mobile device behaviors that require further observation in greater detail;

means for dynamically determining a level of detail required for the further observation;

means for performing finer observations based on the determined level of detail required for the further observation; and

means for identifying suspicious behavior from the finer observations.

118. The computing device of claim 117, further comprising:

means for performing mobile devices operations to correct the identified suspicious behavior.

119. A non-transitory processor-readable storage medium having stored thereon processor-executable instructions to cause a processor to perform operations comprising:

performing on a mobile device processor real-time behavior analysis of one or more mobile device behaviors to generate coarse observations;

identifying suspicious behavior from the coarse observations;

dynamically determining the mobile device behaviors that require further observation in greater detail;

dynamically determining a level of detail required for the further observation;

performing finer observations based on the determined level of detail required for the further observation; and

identifying suspicious behavior from the finer observations.

120. The non-transitory processor-readable storage medium of claim 119, wherein the stored processor-executable instructions are configured to cause a processor to perform operations further comprising:

performing mobile devices operations to correct the identified suspicious behavior.