Abstract:
The subject matter disclosed herein relates to systems, methods, apparatuses, devices, articles, and means for updating radio models. For certain example implementations, a method for one or more server devices may comprise receiving at one or more communication interfaces at least one measurement that corresponds to a position of a first mobile device within an indoor environment. At least one radio model that is stored in one or more memories may be updated based, at least in part, on the at least one measurement to produce at least one updated radio model. The at least one radio model and the at least one updated radio model may correspond to the indoor environment. The at least one updated radio model may be transmitted to enable a second mobile device to use the at least one updated radio model for positioning within the indoor environment. Other example implementations are described herein.
Abstract:
Systems and methods for recognizing and reacting to malicious or performance-degrading behaviors in a mobile device include observing mobile device behaviors in an observer module within a privileged-normal portion of a secure operating environment to identify a suspicious mobile device behavior. The observer module may generate a concise behavior vector based on the observations, and provide the vector to an analyzer module in an unprivileged-secure portion of the secure operating environment. The vector may be analyzed in the unprivileged-secure portion to determine whether the mobile device behavior is benign, suspicious, malicious, or performance-degrading. If the behavior is found to be suspicious, operations of the observer module may be adjusted, such as to perform deeper observations. If the behavior is found to be malicious or performance-degrading behavior the user and/or a client module may be alerted in a secure, tamper-proof manner.
Abstract:
Methods, systems and devices for communicating behavior analysis information using an application programming interface (API) may include receiving data/behavior models from one or more third-party network servers in a client module of a mobile device and communicating the information to a behavior observation and analysis system via a behavior API. The third-party servers may be maintained by one or more partner companies that have domain expertise in a particular area or technology that is relevant for identifying, analyzing, classifying, and/or reacting to mobile device behaviors, but that do not have access to (or knowledge of) the various mobile device sub-systems, interfaces, configurations, modules, processes, drivers, and/or hardware systems required to generate effective data/behavior models suitable for use by the mobile device. The behavior API and/or client modules allow the third-party server to quickly and efficiently access the most relevant and important information on the mobile device.
Abstract:
Disclosed is a method for malicious activity detection in a mobile station of a particular model. In the method, generic malicious behavior patterns are received from a network-based malicious behavior profiling system. Mobile-station-model-specific-behavior-analysis algorithms are generated in the mobile station based on the generic malicious behavior patterns. Mobile station operations may be observed to generate a mobile station activity observation. The mobile station activity observation may be analyzed using the mobile-station-model-specific-behavior-analysis algorithms to generate an activity analysis. Malicious activity may be detected based on the activity analysis.
Abstract:
Ambiguity (e.g., confusion) associated with access point identifiers may be resolved by querying candidate target access points and/or by using historical records indicative of one or more access points that the access point has previously accessed. For example, messages may be sent to access points that are assigned the same identifier to cause the access points to monitor for a signal from an access terminal that received the identifier from a target access point. The target access point may then be identified based on any responses that indicate that a signal was received from the access terminal. In some aspects the access points subject to being queried may be selected using a tiered priority. In addition, it may be determined based on prior handoffs of a given access terminal that when that access terminal reports a given identifier, the access terminal usually ends up being handed-off to a particular access point. Accordingly, a mapping may be maintained for that access terminal that maps the identifier to that access point so that the mapping may be used to resolve any future confusion associated with the use of that identifier by that access terminal.
Abstract:
Ambiguity (e.g., confusion) associated with access point identifiers may be resolved by querying candidate target access points and/or by using historical records indicative of one or more access points that the access point has previously accessed. For example, messages may be sent to access points that are assigned the same identifier to cause the access points to monitor for a signal from an access terminal that received the identifier from a target access point. The target access point may then be identified based on any responses that indicate that a signal was received from the access terminal In some aspects the access points subject to being queried may be selected using a tiered priority. In addition, it may be determined based on prior handoffs of a given access terminal that when that access terminal reports a given identifier, the access terminal usually ends up being handed-off to a particular access point. Accordingly, a mapping may be maintained for that access terminal that maps the identifier to that access point so that the mapping may be used to resolve any future confusion associated with the use of that identifier by that access terminal
Abstract:
Systems, methods, and devices of the various aspects enable detecting a malfunction caused by radio frequency (RF) interference. A computing device processor may identify a location of the computing device based on a plurality of real-time data inputs received by the computing device. The processor may characterize an RF environment of the computing device based on the identified location and the plurality of real-time data inputs. The processor may determine at least one RF emissions threshold based on the characterization of the RF environment. The processor may compare the characterization of the RF environment to the at least one RF emissions threshold, and may perform an action in response to determining that the characterization of the RF environment exceeds the at least one RF emissions threshold.
Abstract:
A method of disambiguating a location of a mobile station within a structure includes: obtaining, at the mobile station, regional pressure indications and corresponding region indications indicating regions within a structure that are vertically displaced with respect to each other, each of the regional pressure indications indicating atmospheric pressure information associated with the corresponding region; determining mobile station pressure information associated with a present location of the mobile station; comparing the mobile station pressure information with the regional pressure indications; and based on the comparing, determining in which of the regions the mobile station presently resides.
Abstract:
A computing device may use machine learning techniques to determine whether a side channel attack is underway and perform obfuscation operations (e.g., operations to raise the noise floor) or other similar operations to stop or prevent a detected side channel attack. The computing device may determine that a side channel attack is underway in response to determining that the computing device is in airplane mode, that the battery of the computing device the battery has been replaced with a stable DC power supply, that the touch-screen display of the computing device has been disconnected, that there are continuous calls to a cipher application programming interface (API) using the same cipher key, that there has been tampering with a behavioral analysis engine of the computing device, or any combination thereof.
Abstract:
Various aspects provide methods implemented by at least one processor executing on a mobile communication device to efficiently identify, classify, model, prevent, and/or correct the non-benign (e.g., performance degrading) conditions and/or behaviors that are related to an application operating on the device. Specifically, in various aspects, the mobile computing device may derive or extract application-specific features by performing a binary analysis of an application and may determine the application's category (e.g., a “games,” “entertainment,” or “news” category) based on the application-specific features. The mobile computing device may also obtain a classifier model associated with the application's category that includes various conditions, features, behaviors and corrective actions that may be used to quickly identify and correct non-benign behaviors (e.g., undesirable, malicious, and/or performance-degrading behaviors) occurring on the mobile computing device that are related to the application.