Methods and systems for aggregated multi-application behavioral analysis of mobile device behaviors

Patent metadata

Field	Value
Publication number	US-9710752-B2
Application number	US-201414483800-A
Country	US
Kind code	B2
Filing date	Sep 11, 2014
Priority date	Sep 11, 2014
Publication date	Jul 18, 2017
Grant date	Jul 18, 2017

Abstract

A computing device processor may be configured with processor-executable instructions to implement methods of using behavioral analysis and machine learning techniques to evaluate the collective behavior of two or more software applications operating on the device. The processor may be configured to monitor the activities of a plurality of software applications operating on the device, collect behavior information for each monitored activity, generate a behavior vector based on the collected behavior information, apply the generated behavior vector to a classifier model to generate analysis information, and use the analysis information to classify a collective behavior of the plurality of software applications.

First claim

What is claimed is:

1. A method of analyzing a behavior of a computing device, comprising:
monitoring, in a processor of the computing device, activities and interactions between a plurality of software applications on the computing device to collect behavior information;
aggregating behavior information collected from multiple individual software applications;
generating a behavior vector information structure that includes a plurality of numerical values that characterize a collective behavior of two or more of the plurality of software applications based on the aggregated behavior information;
applying the generated behavior vector information structure to a multi-application classifier model to evaluate each test condition included in the multi-application classifier model and generate analysis information, wherein each test condition in the multi-application classifier model tests a condition relevant to evaluating a relationship between two or more of the plurality of software applications;
using the generated analysis information to:
categorize the monitored plurality of software applications;
generating performance numbers for each category of the plurality of software applications;
determine whether two or more of the plurality of software applications are working in concert;
evaluate the collective behavior of two or more of the plurality of software applications; and
generate evaluation results; and

determining whether the collective behavior is non-benign based on the generated evaluation results.

2. The method of claim 1 , wherein generating the behavior vector information structure that includes the plurality of numerical values that characterize the collective behavior of two or more of the plurality of software applications based on the aggregated behavior information comprises generating an information structure that characterizes the collective behavior of all of the software applications in the plurality of software applications via the plurality of numerical values.

3. The method of claim 1 , wherein generating the behavior vector information structure that includes the plurality of numerical values that characterize the collective behavior of two or more of the plurality of software applications based on the aggregated behavior information comprises generating an information structure that characterizes the relationship between two or more of the plurality of software applications via the plurality of numerical values.

4. The method of claim 1 , wherein using the generated analysis information further comprises identifying two or more software applications that should be evaluated together as a group.

5. The method of claim 4 , further comprising:
monitoring additional activities of the identified two or more software applications to collect additional behavior information;
generating a collective behavior vector that characterizes the collective behavior of the identified two or more software applications based on the collected additional behavior information;
applying the generated collective behavior vector to the multi-application classifier model to generate additional analysis information; and
using the additional analysis information to determine whether the collective behavior of the identified two or more software applications is non-benign.

6. The method of claim 4 , further comprising:
applying behavior vectors that each characterizes the behavior of the identified two or more software applications to the multi-application classifier model to generate additional analysis information;
aggregating the additional analysis information generated for each of the behavior vectors; and
using the aggregated analysis information to determine whether the collective behavior of the identified two or more software applications is non-benign.

7. The method of claim 1 , further comprising:
computing a weighted average of each result of evaluating test conditions in the multi-application classifier model;
wherein determining whether the collective behavior is non-benign based on the generated evaluation results comprises determining whether the collective behavior is non-benign based on the weighted average.

8. The method of claim 1 , wherein using the generated analysis information further comprises profiling each category of the plurality of software applications.

9. A computing device, comprising:
a processor configured to:
monitor activities and interactions between a plurality of software applications on the computing device to collect behavior information;
aggregate behavior information collected from multiple individual software applications;
generate a behavior vector information structure that includes a plurality of numerical values that characterize a collective behavior of two or more of the plurality of software applications based on the aggregated behavior information;
apply the generated behavior vector information structure to a multi-application classifier model to evaluate each test condition included in the multi-application classifier model and generate analysis information, wherein each test condition in the multi-application classifier model tests a condition relevant to evaluating a relationship between two or more of the plurality of software applications;
use the generated analysis information to:
categorize the monitored plurality of software applications;
generating performance numbers for each category of the plurality of software applications;
determine whether two or more of the plurality of software applications are working in concert;
evaluate the collective behavior of two or more of the plurality of software applications; and
generate evaluation results; and

determine whether the collective behavior is non-benign based on the generated evaluation results.

10. The computing device of claim 9 , wherein the processor is further configured with processor-executable instructions to generate the behavior vector information structure that includes the plurality of numerical values that characterize the collective behavior of two or more of the plurality of software applications based on the collected aggregated behavior information by generating an information structure that characterizes the collective behavior of all of the software applications in the plurality of software applications via the plurality of numerical values.

11. The computing device of claim 9 , wherein the processor is further configured with processor-executable instructions to generate the behavior vector information structure that includes the plurality of numerical values that characterize the collective behavior of two or more of the plurality of software applications based on the aggregated behavior information by generating an information structure that characterizes a relationship between two or more of the plurality of software applications via the plurality of numerical values.

12. The computing device of claim 9 , wherein the processor is further configured with processor-executable instructions such that using the generated analysis information further comprises identifying two or more software applications that should be evaluated together as a group.

13. The computing device of claim 12 , wherein the processor is further configured with processor-executable instructions to:
monitor additional activities of the identified two or more software applications to collect additional behavior information;
generate a collective behavior vector that characterizes the collective behavior of the identified two or more software applications based on the collected additional behavior information;
appl

Assignees

• Qualcomm Inc

Inventors

• Salajegheh Mastooreh
• Chen Yin

Classifications

• G06F11/3447 Primary

  Performance evaluation by modeling · CPC title

• G06F8/443

  Optimisation · CPC title

• G06F2201/865

  Monitoring of software · CPC title

• G06F11/3466

  Performance evaluation by tracing or monitoring · CPC title

• G06N5/04 Primary

  Inference or reasoning models · CPC title