APIs for obtaining device-specific behavior classifier models from the cloud

Patent metadata

Field	Value
Publication number	US-9491187-B2
Application number	US-201414157606-A
Country	US
Kind code	B2
Filing date	Jan 17, 2014
Priority date	Feb 15, 2013
Publication date	Nov 8, 2016
Grant date	Nov 8, 2016

Abstract

The various aspects provide a system and methods implemented on the system for generating a behavior model on a server that includes features specific to a mobile computing device and the device's current state/configuration. In the various aspects, the mobile computing device may send information identifying itself, its features, and its current state to the server. In response, the server may generate a device-specific lean classifier model for the mobile computing device based on the device's information and state and may send the device-specific lean classifier model to the device for use in detecting malicious behavior. The various aspects may enhance overall security and performance on the mobile computing device by leveraging the superior computing power and resources of the server to generate a device-specific lean classifier model that enables the device to monitor features that are actually present on the device for malicious behavior.

First claim

What is claimed is:

1. A method of generating a lean classifier model on a server for use by a mobile computing device in monitoring for malicious behaviors, comprising:
receiving, on the server, information from the mobile computing device identifying at least one capability and a state of the mobile computing device;
obtaining a cloud data set of information collected from a plurality of other mobile computing devices;
generating, on the server, a lean classifier model specific to the mobile computing device, wherein generating the mobile computing device-specific lean classifier model comprises filtering the cloud data set of information based on the at least one capability and the state of the mobile computing device; and
sending, from the server to the mobile computing device, the mobile computing device-specific lean classifier model,
wherein the mobile device-specific lean classifier model comprises a processor-executable information structure configured to enable a system reliability module on the mobile computing device to classify behavior of the mobile computing device, wherein classifying behavior comprises analyzing features specific to the at least one capability and the state of the mobile computing device.

2. The method of claim 1 , further comprising:
determining on the server whether there is a stored lean classifier model associated with the at least one capability and the state of the mobile computing device,
wherein:
generating the mobile computing device-specific lean classifier model comprises retrieving the stored lean classifier model in response to determining that there is a stored lean classifier model associated with the at least one capability and the state of the mobile computing device; and
sending the mobile computing device-specific lean classifier model from the server to the mobile computing device comprises sending the stored lean classifier model from the server to the mobile computing device in response to determining that there is a stored classifier model associated with the at least one capability and the state of the mobile computing device.

3. The method of claim 1 , wherein generating on the server a mobile computing device-specific lean classifier model further comprises training the cloud data set of information with the information received from the mobile computing device identifying the at least one capability and the state of the mobile computing device.

4. The method of claim 1 , further comprising:
storing the lean classifier model in the server;
determining, on the server, whether to update the stored lean classifier model; and
in response to determining to update the stored lean classifier model:
training an updated cloud data set on the server with the information received from the mobile computing device identifying the at least one capability and the state of the mobile computing device to produce an updated lean classifier model; and
sending the updated lean classifier model from the server to the mobile computing device.

5. The method of claim 1 , further comprising:
determining, on the mobile computing device, a set of device-specific features associated with the at least one capability of the mobile computing device;
determining, on the mobile computing device, a set of state-specific features associated with the state of the mobile computing device,
generating, on the mobile computing device, the information identifying the at least one capability and the state of the mobile computing device based on the set of device-specific features and the set of state-specific features; and
sending the generated information from the mobile computing device to the server.

6. The method of claim 5 , further comprising:
determining, on the mobile computing device, whether a change in functionality on the mobile computing device has been detected;
determining, on the mobile computing device, whether a change in state of the mobile computing device has been detected; and
in response to detecting a change in at least one of functionality and state:
updating the generated information in the mobile computing device;
sending updated information from the mobile computing device to the server; and
receiving, on the mobile computing device, an updated lean classifier model from the server based on the updated information and in response to sending the updated information.

7. The method of claim 5 , further comprising receiving, on the mobile computing device, a user input indicating the at least one capability and the state of the mobile computing device, wherein:
determining the set of device-specific features and the set of state-specific features on the mobile computing device is based on the user input.

8. The method of claim 7 , wherein receiving, on the mobile computing device, a user input indicating the at least one capability and the state of the mobile computing device comprises receiving on the mobile computing device a user input indicating at least one anticipated capability and an anticipated state of the mobile computing device.

9. A server, comprising:
a processor configured with processor-executable instructions to perform operations comprising:
receiving information from a mobile computing device identifying at least one capability and a state of the mobile computing device;
obtaining a cloud data set of information collected from a plurality of other mobile computing devices;
generating a lean classifier model specific to the mobile computing device, wherein generating the mobile computing device-specific lean classifier model comprises filtering the cloud data set of information based on the at least one capability and the state of the mobile computing device; and
sending the mobile computing device-specific lean classifier model to the mobile computing device,
wherein the mobile computing device-specific lean classifier model comprises a processor-executable information structure configured to enable a system reliability module on the mobile computing device to classify behavior of the mobile computing device, wherein classifying behavior comprises analyzing features that are specific to the at least one capability and the state of the mobile computing device.

10. The server of claim 9 , wherein:
the processor is configured with processor-executable instructions to perform operations further comprising determining whether there is a stored lean classifier model associated with the at least one capability and the state of the mobile computing device,
wherein:
the processor is configured with processor-executable instructions such that generating the mobile computing device-specific lean classifier model comprises retrieving the sorted lean classifier model in response to determining that there is a stored lean classifier model associated with the at least one capability and the state of the mobile computing device; and
sending the mobile computing device-specific lean classifier model to the mobile computing device comprises sending the stored lean classifier model to the mobile computing device in response to determining that there is a stored classifier model associated with the at least one capability and the state of the mobile computing device.

11. The server of claim 9 , wherein the processor is configured with processor-executable instructions to perform operations such that generating a mobile computing device-specific lean classifier model further comprises training the cloud data set of information with the information received from the mobile computing device identifying the at least one capability and the state of the mobile computing device.

12. The server o

Assignees

• Qualcomm Inc

Inventors

• Sridhara Vinay
• Gupta Rajarshi

Classifications

• H04W4/00

  Services specially adapted for wireless communication networks; Facilities therefor · CPC title

• H04L67/303

  Terminal profiles · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title