Methods, devices, and systems for communicating behavioral analysis information

Patent metadata

Field	Value
Publication number	US-9609456-B2
Application number	US-201414339809-A
Country	US
Kind code	B2
Filing date	Jul 24, 2014
Priority date	May 14, 2012
Publication date	Mar 28, 2017
Grant date	Mar 28, 2017

Abstract

Methods, systems and devices for communicating behavior analysis information using an application programming interface (API) may include receiving via the API a request to register the second module to access an operation of a behavioral monitoring system of the mobile computing device, and exchanging authentication information between the first module and the second module to accomplish mutual authentication. Aspects may include receiving via the API a request for version identification information that may be used by the server to determine how to interpret, evaluate, or crowd-source information, and exchanging version identification information between the first module and the second module to cause the second module to send the information to the server. Aspects may further include receiving via the API a provision malware model request including a command causing the first module to send a malware or classifier model to a behavioral monitoring system of the mobile computing device.

First claim

What is claimed is:

1. A method of communicating information between components of a mobile computing device to communicate with a server, comprising:
receiving, by a mobile device processor of the mobile computing device and in a first component of the mobile computing device, a registration request from a second component of the mobile computing device via an application programming interface (API);
exchanging authentication information between the first component and the second component via the API to accomplish mutual authentication in response to the first component receiving the registration request;
invoking, by the second component, an operation of a behavioral monitoring system of the mobile computing device in response to accomplishing mutual authentication;
collecting, by the first component, behavior information regarding behavior features observed in the mobile computing device in response to the second component invoking the operation of the behavioral monitoring system;
exchanging the collected behavior information between the first component and the second component via the API to cause the second component to send the collected behavior information to the server.

2. The method of claim 1 , further comprising:
receiving via the API a request for version identification information that is suitable for use by the server in determining how to interpret, evaluate, or crowd-source information; and
exchanging the version identification information between the first component and the second component to cause the second component to send the version identification information to the server.

3. The method of claim 1 , further comprising:
receiving via the API a provision model request that includes a command suitable for causing the first component to send a classifier model to the behavioral monitoring system of the mobile computing device.

4. The method of claim 1 , further comprising:
receiving a request observation request for the mobile computing device to monitor or observe a specific mobile computing device behavior; and
exchanging the request observation request between the second component and the first component to cause the mobile computing device to monitor or observe the specific mobile computing device behavior.

5. The method of claim 1 , further comprising:
receiving via the API a request to receive information regarding an occurrence of a condition or event; and
exchanging version identification information between the first component and the second component to cause the second component to send specific information regarding the occurrence of the condition or event to the server.

6. The method of claim 1 , further comprising:
receiving via the API a request for actuation that includes a command suitable for causing the mobile computing device to uninstall an application, block a process, or terminate the process.

7. The method of claim 1 , further comprising:
receiving via the API a request for automatic actuation that includes a command suitable for causing the mobile computing device to define a condition or event that will cause the mobile computing device to perform an actuation operation.

8. The method of claim 7 , wherein the actuation operation includes one of uninstalling an application, blocking a process, and terminating the process.

9. A mobile computing device, comprising:
a processor configured with processor-executable instructions to perform operations, comprising:
receiving in a first component of the mobile computing device a registration request from a second component of the mobile computing device via an application programming interface (API);
exchanging authentication information between the first component and the second component via the API to accomplish mutual authentication in response to the first component receiving the registration request;
invoking, by the second component, an operation of a behavioral monitoring system of the mobile computing device in response to accomplishing mutual authentication;
collecting, by the first component, behavior information regarding behavior features observed in the mobile computing device in response to the second component invoking the operation of the behavioral monitoring system;
exchanging the collected behavior information between the first component and the second component via the API to cause the second component to send the collected behavior information to a server.

10. The mobile computing device of claim 9 , wherein the processor is further configured with processor-executable instructions to perform operations comprising:
receiving via the API a request for version identification information that is suitable for use by the server in determining how to interpret, evaluate, or crowd-source information; and
exchanging the version identification information between the first component and the second component to cause the second component to send the version identification information to the server.

11. The mobile computing device of claim 9 , wherein the processor is further configured with processor-executable instructions to perform operations comprising:
receiving via the API a provision model request that includes a command suitable for causing the first component to send a or classifier model to the behavioral monitoring system of the mobile computing device.

12. The mobile computing device of claim 9 , wherein the processor is further configured with processor-executable instructions to perform operations comprising:
receiving a request observation request for the mobile computing device to monitor or observe a specific mobile computing device behavior; and
exchanging the request observation request between the second component and the first component to cause the mobile computing device to monitor or observe the specific mobile computing device behavior.

13. The mobile computing device of claim 9 , wherein the processor is further configured with processor-executable instructions to perform operations comprising:
receiving via the API a request to receive information regarding an occurrence of a condition or event; and
exchanging version identification information between the first component and the second component to cause the second component to send specific information regarding the occurrence of the condition or event to the server.

14. The mobile computing device of claim 9 , wherein the processor is further configured with processor-executable instructions to perform operations comprising:
receiving via the API a request for actuation that includes a command suitable for causing the mobile computing device to uninstall an application, block a process, or terminate the process.

15. The mobile computing device of claim 9 , wherein the processor is further configured with processor-executable instructions to perform operations comprising:
receiving via the API a request for automatic actuation that includes a command suitable for causing the mobile computing device to define a condition or event that will cause the mobile computing device to perform an actuation operation.

16. The mobile computing device of claim 15 , wherein the actuation operation includes one of uninstalling an application, blocking a process, and terminating the process.

17. A non-transitory processor-readable storage medium having stored thereon processor-executable instructions to cause a processor of a mobile computing device to perform operations comprising:
receiving in a first component of the mobile computing device a registration request from

Assignees

• Qualcomm Inc

Inventors

• Valencia Andres
• Gupta Rajarshi
• Christodorescu Mihai

Classifications

• G06F8/71

  Version control (security arrangements therefor G06F21/57); Configuration management · CPC title

• G06F21/567

  using dedicated hardware · CPC title

• H04W4/00 Primary

  Services specially adapted for wireless communication networks; Facilities therefor · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• H04M3/00

  Automatic or semi-automatic exchanges · CPC title