Abstract:
Mobile computing devices may be equipped with hardware components configured to monitor key assets of the mobile device at a low level (e.g., firmware level, hardware level, etc.). The hardware component may also be configured to dynamically determine the key assets that are to be monitored in the mobile device, monitor the access or use of these key assets by monitoring data flows, transactions, or operations in a system data bus of the mobile device, and report suspicious activities to a comprehensive behavioral monitoring and analysis system of the mobile device. The comprehensive behavioral monitoring and analysis system may then use this information to quickly identify and respond to malicious or performance degrading activities of the mobile device.
Abstract:
The various aspects provide for a computing device and methods implemented by the device to ensure that an application executing on the device and seeking root access will not cause malicious behavior while after receiving root access. Before giving the application root access, the computing device may identify operations the application intends to execute while having root access, determine whether executing the operations will cause malicious behavior by simulating execution of the operations, and pre-approve those operations after determining that executing those operations will not result in malicious behavior. Further, after giving the application root access, the computing device may only allow the application to perform pre-approved operations by quickly checking the application's pending operations against the pre-approved operations before allowing the application to perform those operations. Thus, the various aspects may ensure that an application receives root access without compromising the performance or security integrity of the computing device.
Abstract:
Methods, systems and devices use operating system execution states while monitoring applications executing on a mobile device to perform comprehensive behavioral monitoring and analysis include configuring a mobile device to monitor an activity of a software application, generate a shadow feature value that identifies an operating system execution state of the software application during that activity, generate a behavior vector that associates the monitored activity with the shadow feature value, and determine whether the activity is malicious or benign based on the generated behavior vector, shadow feature value and/or operating system execution states. The mobile device may also be configured to intelligently determine whether the operating system execution state of a software application is relevant to determining whether any of the monitored mobile device behaviors are malicious or suspicious, and monitor only the operating system execution states of the software applications for which such determinations are relevant.
Abstract:
In one implementation, a method may comprise: determining a topological representation of an indoor portion of a building based, at least in part, on positions or number of lines in an image of the indoor portion of the building; and comparing the topological representation to one or more stored topological representations, for example in a digital map of the building, to determine a potential position of the indoor portion of the building.
Abstract:
The subject matter disclosed herein relates to a system and method for determining indoor context information relating to a location of a mobile device. Indoor context information may be utilized by a mobile device or a network element to obtain an estimate of a location of the mobile device within an indoor environment.
Abstract:
Disclosed is a method for efficient behavioral analysis on a mobile station. In the method, one or more first behavioral characteristics associated with a first state of a finite state machine are observed. The one or more first behavioral characteristics may comprise a first subset of observable behavioral characteristics. The mobile station transitions from the first state to a second state. One or more second behavioral characteristics associated with the second state of the finite state machine are observed. The one or more second behavioral characteristics may comprise a second subset of the observable behavioral characteristics.
Abstract:
A method for synchronizing a wireless communication system is disclosed. A silence duration for a base station is determined based on the time required for a neighbor base station to obtain or maintain synchronization. All transmissions from the base station are ceased for the silence duration. Multiple base stations level may cease transmissions at the same time, thus mitigating interference.
Abstract:
The various aspects include methods, systems, and devices configured to make use of caching techniques and behavior signature caches to improve processor performance and/or reduce the amount of power consumed by the computing device by reducing analyzer latency. The signature caching system may be configured to adapt to rapid and frequent changes in behavioral specifications and models and provide a multi-fold improvement in the scalability of behavioral analysis operations performed on the mobile device.
Abstract:
Aspect methods, systems and devices may be configured to create/capture checkpoints without significantly impacting the performance, power consumption, or responsiveness of the mobile device. An observer module of the mobile device may instrument or coordinate various application programming interfaces (APIs) at various levels of the mobile device system and constantly monitor the mobile device (via a low power process, background processes, etc.) to identify the normal operation patterns of the mobile device and/or to identify behaviors that are not consistent with previously computed normal operation patterns. The mobile device may store mobile device state information in a memory as a stored checkpoint when it determines that the mobile device behaviors are consistent with normal operation patterns, and upload a previously stored checkpoint to a backup storage system when it determines that the mobile device behaviors are not consistent with normal operation patterns.
Abstract:
Various embodiments include methods, and computing devices implementing the methods, for analyzing sensor information to identify an abnormal vehicle behavior. A computing device may monitor sensors (e.g., a closely-integrated vehicle sensor, a loosely-integrated vehicle sensor, a non-vehicle sensor, etc.) in the vehicle to collect the sensor information, analyze the collected sensor information to generate an analysis result, and use the generated analysis result to determine whether a behavior of the vehicle is abnormal. The computing device may also generate a communication message in response to determining that the behavior of the vehicle is abnormal, and send the generated communication message to an external entity.