Collaborative learning for efficient behavioral analysis in networked mobile device

摘要

Methods, systems and devices for classifying mobile device behaviors of a first mobile device may include the first mobile device monitoring mobile device behaviors to generate a behavior vector, and applying the behavior vector to a first classifier model to obtain a first determination of whether a mobile device behavior is benign or not benign. The first mobile device may also send the behavior vector to a second mobile device, which may receive and apply the behavior vector to a second classifier model to obtain a second determination of whether the mobile device behavior is benign or not benign. The second mobile device may send the second determination to the first mobile device, which may receive the second determination, collate the first determination and the second determination to generate collated results, and determine whether the mobile device behavior is benign or not benign based on the collated results.

主权项

1. A method of classifying mobile device behaviors of a mobile device, comprising:
monitoring mobile device behaviors in a first mobile device to generate a behavior vector data structure that characterizes a behavior of a software application operating on the first mobile device; applying the behavior vector data structure to a first classifier model in the first mobile device to obtain a first determination of a classification of the behavior of the software application operating on the first mobile device; sending the behavior vector data structure to a second mobile device, the second mobile device applying the behavior vector data structure received from the first mobile device to a second classifier model to obtain a second determination in the second mobile device of the classification of the behavior of the software application operating on the first mobile device and sending the second determination to the first mobile device; collating the first determination and the second determination in the first mobile device to generate collated results; and classifying the behavior of the software application operating on the first mobile device based on the collated results.