Method and System for Inferring Application States by Performing Behavioral Analysis Operations in a Mobile Device

摘要

Methods, systems and devices compute and use the actual execution states of software applications to implement power saving schemes and to perform behavioral monitoring and analysis operations. A mobile device may be configured to monitor an activity of a software application, generate a shadow feature value that identifies actual execution state of the software application during that activity, generate a behavior vector that associates the monitored activity with the shadow feature value, and determine whether the activity is malicious or benign based on the generated behavior vector, shadow feature value and/or operating system execution states. The mobile device processor may also be configured to intelligently determine whether the execution state of a software application is relevant to determining whether any of the monitored mobile device behaviors are malicious or suspicious, and monitor only the execution states of the software applications for which such determinations are relevant.

主权项

1. A method of determining an execution state of a software application or process in a mobile device, the method comprising:
monitoring in a processor of the mobile device an activity of the software application or process to collect behavior information; generating a behavior vector based on the collected behavior information; and determining the execution state of the software application or process by applying a classifier model to the behavior vector.