Methods and systems for minimizing latency of behavioral analysis

摘要

The various aspects include methods, systems, and devices configured to make use of caching techniques and behavior signature caches to improve processor performance and/or reduce the amount of power consumed by the computing device by reducing analyzer latency. The signature caching system may be configured to adapt to rapid and frequent changes in behavioral specifications and models and provide a multi-fold improvement in the scalability of behavioral analysis operations performed on the mobile device.

主权项

1. A mobile device, comprising:
a transceiver configured to establish a network connection; a cache memory; and a processor coupled to the transceiver and the cache memory, and configured with processor-executable instructions to perform operations comprising:
populating the cache memory by:
observing a first group of mobile device behaviors over a period of time;determining whether the cache memory stores a behavior vector that corresponds an observed mobile device behavior; andidentifying a limited set of behaviors that are associated with operations that are inconsistent with normal operation patterns of the mobile device, receiving inputs regarding the limited set of behaviors, performing temporal and spatial correlations of the inputs, generating a first behavior vector based on a result of the spatial and temporal correlations, and storing the first behavior vector in the cache memory in response to determining that the cache memory does not store any behavior vectors that correspond to the observed mobile device behavior; andperforming behavior-based analysis operations comprising:
observing a second group of mobile device behaviors;generating a second behavior vector based on the second group of mobile device behaviors;determining whether the second behavior vector matches one of the behavior vectors stored in the cache memory;taking a corrective action in response to determining that the second behavior vector matches one of the behavior vectors stored in the cache memory;using the second behavior vector to determine whether one or more behaviors in the second group of mobile device behaviors are benign in response to determining that the second behavior vector does not match any of the behavior vectors stored in the cache memory; andstoring the second behavior vector in the cache memory in response to determining that one or more behaviors in the second group of mobile device behaviors are not benign.