System, apparatus, and method for adaptive observation of mobile device behavior

摘要

Methods, devices and systems for detecting suspicious or performance-degrading mobile device behaviors intelligently, dynamically, and/or adaptively determine computing device behaviors that are to be observed, the number of behaviors that are to be observed, and the level of detail or granularity at which the mobile device behaviors are to be observed. The various aspects efficiently identify suspicious or performance-degrading mobile device behaviors without requiring an excessive amount of processing, memory, or energy resources. Various aspects may correct suspicious or performance-degrading mobile device behaviors. Various aspects may prevent identified suspicious or performance-degrading mobile device behaviors from degrading the performance and power utilization levels of a mobile device over time. Various aspects may restore an aging mobile device to its original performance and power utilization levels.

主权项

1. A method for observing mobile device behaviors over a period of time to recognize mobile device behaviors inconsistent with normal operation patterns, the method comprising:
dynamically determining in a processor of a mobile device mobile device behaviors that are to be observed by:
observing mobile device behaviors over the period of time; andidentifying a limited set of behaviors associated with inconsistent operations as the mobile device behaviors to be observed by:
receiving behavior inputs from one or more of a high-level application, a system kernel and a driver application programming interface (API) after filtering by an adaptive filter;receiving a context input regarding operations of the mobile device;performing spatial correlations of the received behavior inputs and the received context input; andgenerating a behavior vector; adaptively observing the determined mobile device behaviors to identify a suspicious mobile device behavior from a limited set of observations; and controlling an observation granularity of the adaptive observation.