Methods and systems of dynamically generating and using device-specific and device-state-specific classifier models for the efficient classification of mobile device behaviors

Patent metadata

Field	Value
Publication number	US-9686023-B2
Application number	US-201314091707-A
Country	US
Kind code	B2
Filing date	Nov 27, 2013
Priority date	Jan 2, 2013
Publication date	Jun 20, 2017
Grant date	Jun 20, 2017

Abstract

The various aspects provide a mobile device and methods implemented on the mobile device for modifying behavior models to account for device-specific or device-state-specific features. In the various aspects, a behavior analyzer module may leverage a full feature set of behavior models (i.e. a large classifier model) received from a network server to create lean classifier models for use in monitoring for malicious behavior on the mobile device, and the behavior analyzer module may dynamically modify these lean classifier models to include features specific to the mobile device and/or the mobile device's current configuration. Thus, the various aspects may enhance overall security for a particular mobile device by taking the mobile device and its current configuration into account and may improve overall performance by monitoring only features that are relevant to the mobile device.

First claim

What is claimed is:

1. A method of generating and using data models in a mobile device, comprising:
receiving, in a processor of the mobile device from a server computing device, a full classifier model, the received full classifier model including a plurality of decision nodes, each decision node in the plurality of decision nodes including a test condition and a weight value;
collecting mobile device-specific information in the mobile device;
identifying combinations of features that require monitoring and analysis in the mobile device, and determining a relative importance of each of the identified feature combinations, based on the collected mobile device-specific information;
culling, via the processor of the mobile device, the received full classifier model to generate a lean classifier model that includes a subset of the plurality of decision nodes included in the received full classifier model, the culling comprising:
identifying decision nodes included in the received full classifier model that include test conditions relevant to evaluating the identified feature combinations;
prioritizing the identified decision nodes based on determined relative importance of the identified feature combinations; and
generating the lean classifier model to include only the identified decision nodes, ordered in accordance with their priority;

generating a behavior vector that characterizes a behavior of the mobile device; and
applying, by the processor of the mobile device, the generated behavior vector to the generated lean classifier model to classify the behavior of the mobile device.

2. The method of claim 1 , wherein:
receiving the full classifier model comprises receiving a finite state machine that includes information that is suitable for conversion to the plurality of decision nodes; and
culling the received full classifier model to generate the lean classifier model that includes the subset of the plurality of decision nodes included in the received full classifier model further comprises generating the lean classifier model to include only the identified decision nodes that evaluate a mobile device feature that is relevant to a current operating state or configuration of the mobile device.

3. The method of claim 2 , wherein culling the received full classifier model to generate the lean classifier model that includes the subset of the plurality of decision nodes included in the received full classifier model further comprises:
determining a number of unique test conditions that should be evaluated to classify the behavior without consuming an excessive amount of processing, memory, or energy resources of the mobile device;
generating a list of test conditions by sequentially traversing the plurality of test conditions in the full classifier model and inserting those test conditions that are relevant to classifying the behavior of the mobile device into the list of test conditions until the list of test conditions includes the determined number of unique test conditions; and
generating the lean classifier model to include decision nodes in the full classifier model that test one of the test conditions included in the generated list of test conditions.

4. The method of claim 2 , wherein applying the generated behavior vector to the generated lean classifier model in the mobile device to classify the behavior of the mobile device comprises using the lean classifier model to determine whether the behavior is not benign by:
applying collected behavior information to each decision node in the lean classifier model;
computing a weighted average of results of applying the collected behavior information to each decision node in the lean classifier model; and
comparing the weighted average to a threshold value.

5. The method of claim 1 , further comprising:
monitoring the mobile device to detect a change in one of:
a state of the mobile device,
a configuration of the mobile device,
a capability of the mobile device, and
a functionality of the mobile device;

modifying the lean classifier model to include an updated set of test conditions in response to detecting the change; and
using the modified lean classifier model to classify the behavior of the mobile device.

6. The method of claim 5 , wherein monitoring the mobile device and modifying the lean classifier model to include the updated set of test conditions in response to detecting the change comprises:
identifying an added mobile device feature associated with the detected change;
determining whether the identified added mobile device feature is included in the generated lean classifier model; and
adding the identified feature to the generated lean classifier model in response to determining that the identified feature is not included in the generated lean classifier model.

7. The method of claim 5 , wherein monitoring the mobile device and modifying the lean classifier model to include the updated set of test conditions in response to detecting the change comprises:
detecting the change in the capability of the mobile device by detecting an addition of an auxiliary component to the mobile device;
determining whether the lean classifier model includes any test conditions that evaluate the auxiliary component;
determining whether the full classifier model includes any test conditions for the auxiliary component in response to determining that the lean classifier model does not include any test conditions that evaluate the auxiliary component; and
adding a new decision node that includes a new test condition associated with the auxiliary component to the lean classifier model in response to determining that the full classifier model includes test conditions for the auxiliary component.

8. The method of claim 5 , wherein monitoring the mobile device and modifying the lean classifier model to include the updated set of test conditions in response to detecting the change comprises:
detecting the change in the functionality of the mobile device;
determining whether the detected change in functionality represents added or removed functionality;
determining whether the lean classifier model includes any test conditions that evaluate a mobile device feature affected by the detected change in functionality in response to determining that the detected change in functionality represents added functionality;
determining whether the full classifier model includes any test conditions that evaluate the mobile device feature in response to determining that the lean classifier model does not include any test conditions that evaluate the mobile device feature; and
adding a new decision node that includes a new test condition that evaluates the mobile device feature affected by the detected change to the lean classifier model in response to determining that the full classifier model includes test conditions that evaluate the mobile device feature.

9. The method of claim 5 , wherein monitoring the mobile device and modifying the lean classifier model to include the updated set of test conditions in response to detecting the change comprises:
determining whether there has been the change in state on the mobile device;
identifying a feature that is relevant to a previous state of the mobile device and not relevant to a current state of the mobile device in response to determining that there has been the change in state on the mobile device; and
removing from the lean classifier model test conditions associated with the identified feature.

10. A mobile device, comprising:
a processor configured with processor-executable instructions to perform operations comprising:
receiving from a server computing device a full classifier model, the re

Assignees

• Qualcomm Inc

Inventors

• Sridhara Vinay
• Gupta Rajarshi
• Fawaz Kassem

Classifications

• G06N20/00

  Machine learning · CPC title

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• H04B17/391 Primary

  Modelling the propagation channel · CPC title

• H04B17/00 Primary

  Monitoring; Testing (of line transmission systems H04B3/46; arrangements for monitoring or testing transmission systems employing electromagnetic waves other than radio waves H04B10/07) · CPC title

• G06N5/043

  Distributed expert systems; Blackboards · CPC title