Abstract:
Disclosed is an apparatus and method for a computing device to determine if an application is malware. The computing device may include: a query logger to log the behavior of the application on the computing device to generate a log; a behavior analysis engine to analyze the log from the query logger to generate a behavior vector that characterizes the behavior of the application; and a classifier to classify the behavior vector for the application as benign or malware.
Abstract:
Methods, systems, and devices for providing data from a server to a UAV, enabling the UAV to navigate with respect to areas of restricted air space (“restricted areas”). A server may receive from a UAV, a request for restricted area information based on a position of the UAV. The server may determine boundaries of a surrounding area containing the position of the UAV and a number of restricted areas. The server may transmit coordinate information to the UAV defining the restricted areas contained within the surrounding area.
Abstract:
Various embodiments provide methods, devices, and non-transitory processor-readable storage media enabling network path probing with a communications device by sending probes via a network connection to a STUN server and receiving probe replies. The communications device may increment a counter and transmit a test probe configured to be dropped at the first access point (NAT) causing all subsequent NATs to release their IP/port mappings. The communications device may send another probe to the STUN server and receive a probe reply. The communications device may compare the first and second probe replies to determine whether the final IP addresses within the network path match. By continuously incrementing the counter and querying access points, the communications device may determine the number of access points lay along any given network path. The presence of addition or unexpected numbers of NAT Servers may indicate the presence of a rogue access point.
Abstract:
As part of a localized positioning solution, a mobile device may transmit a request message to a server to obtain information about location contexts near the mobile device. In response, the server may, in some implementations, transmit a response message back to the mobile device that identifies a list of nearby LCIs and an area that encompasses these LCIs. The mobile device may store the returned LCI information and the returned area information in corresponding databases for later use. In some implementations, time limits may be placed on the returned area information after which the information is deemed stale.
Abstract:
Methods, systems and devices for communicating behavior analysis information using an application programming interface (API) may include receiving data/behavior models from one or more third-party network servers in a client module of a mobile device and communicating the information to a behavior observation and analysis system via a behavior API. The third-party servers may be maintained by one or more partner companies that have domain expertise in a particular area or technology that is relevant for identifying, analyzing, classifying, and/or reacting to mobile device behaviors, but that do not have access to (or knowledge of) the various mobile device sub-systems, interfaces, configurations, modules, processes, drivers, and/or hardware systems required to generate effective data/behavior models suitable for use by the mobile device. The behavior API and/or client modules allow the third-party server to quickly and efficiently access the most relevant and important information on the mobile device.
Abstract:
Various embodiments include a honeypot system configured to trigger malicious activities by malicious applications using a behavioral analysis algorithm and dynamic resource provisioning. A method performed by a processor of a computing device, which may be a mobile computing device, may include determining whether or not a target application currently executing on the computing device is potentially malicious based, at least in part, on the analysis, predicting a triggering condition of the target application in response to determining the target application is potentially malicious, provisioning one or more resources based, at least in part, on the predicted triggering condition, monitoring activities of the target application corresponding to the provisioned one or more resources, and determining whether or not the target application is a malicious application based, at least in part, on the monitored activities. The resources may be device components (e.g., network interface(s), sensor(s), etc.) and/or data (e.g., files, etc.).
Abstract:
Method and devices of detecting a malware infection of a computing device in a communication network are disclosed. A computing device may monitor outputs of temperature sensors associated with elements of the computing device. The monitored outputs of the temperature sensors may be compared to a profile of temperatures associated with normal operation of the computing device. A deviation of the monitored temperatures from the profile of temperatures associated with normal operation may be reported. The profile of temperatures associated with the normal operation of the computing device may be learned based on temperature sensor data obtained during normal operations. Learning the profile of temperatures may include monitoring outputs of temperature sensors associated with elements of the computing device during normal operation of the computing device and storing the monitored outputs as one or more profiles of temperatures associated with normal operation of the computing device.
Abstract:
Methods and apparatuses are provided which may be implemented in various devices to generate positioning assistance data and/or the like by mobile station with regard to at least one of a plurality of different indoor regions.
Abstract:
Methods, and computing devices implementing the methods, use application-based classifier models to improve the efficiency and performance of a comprehensive behavioral monitoring and analysis system predicting whether a software application is causing undesirable or performance depredating behavior. The application-based classifier models may include a reduced and more focused subset of the decision nodes that are included in a full or more complete classifier model that may be received or generated in the computing device. The application groups may be represented by application groups formed of computing device applications sharing related features, and may be generated using one or more clustering algorithms. Lean classifier models may be generated for each of the application group and may incorporate historical user input regarding execution permissions for features of applications within an application group.
Abstract:
Various aspects provide systems and methods for optimizing hardware monitoring on a computing device. A computing device may receive a monitoring request to monitor a portion of code or data within a process executing on the computing device. The computing device may generate from the monitoring request a first monitoring configuration parameter for a first hardware monitoring component in the computing device and may identify a non-optimal event pattern that occurs while the first hardware monitoring component monitors the portion of code or data according to the first monitoring configuration parameter. The computing device may apply a transformation to the portion of code or data and reconfigure the first hardware monitoring component by modifying the first monitoring configuration parameter in response to the transformation of the portion of code or data.