Abstract:
Methods, and computing devices implementing the methods, improve the efficiency and performance of a comprehensive behavioral monitoring and analysis system that is configured to predict whether a software application is causing undesirable or performance depredating behavior. The behavioral monitoring and analysis system may be configured to quickly and efficiently classify certain software applications as being benign by generating a behavior vector that characterizes the activities of the software application, determining whether the generated behavior vector includes a distinguishing behavior or behavioral clue identifying the software application as a trusted software application, and classifying the software application as benign in response to determining that the generated behavior vector includes a distinguishing behavior identifying the software application as a trusted software application.
Abstract:
Various methods, apparatuses and/or articles of manufacture are provided for use in one or more electronic devices to perform and/or otherwise support certain positioning capabilities with regard to a mobile device. For example, certain positioning capabilities may make use of one or more portal transition parameters that may be based, at least in part, on a determined likelihood that a mobile device, if located in a first region of a specific environment and within a threshold area of a portal connecting the first region to a second region of the specific environment, may or may not make use of the portal to transition from the first region to the second region, e.g., through the portal.
Abstract:
Embodiments include computing devices, apparatus, and methods implemented by the apparatus for time varying address space layout randomization. The apparatus may launch first plurality of versions of a system service and assign a random virtual address space layout to each of the first plurality of versions of the system service. The apparatus may receive a first request to execute the system service from a first application. The apparatus may randomly select a first version of the system service from the first plurality of versions of the system service, and execute the system service using data of the first version of the system service.
Abstract:
The disclosure generally relates to behavioral analysis to automate monitoring Internet of Things (IoT) device health in a direct and/or indirect manner. In particular, normal behavior associated with an IoT device in a local IoT network may be modeled such that behaviors observed at the IoT device may be compared to the modeled normal behavior to determine whether the behaviors observed at the IoT device are normal or anomalous. Accordingly, in a distributed IoT environment, more powerful “analyzer” devices can collect behaviors locally observed at other (e.g., simpler) “observer” devices and conduct behavioral analysis across the distributed IoT environment to detect anomalies potentially indicating malicious attacks, malfunctions, or other issues that require customer service and/or further attention. Furthermore, devices with sufficient capabilities may conduct (local) on-device behavioral analysis to detect anomalous conditions without sending locally observed behaviors to another aggregator device and/or analyzer device.
Abstract:
Systems and methods are disclosed for automating customer service for a monitored device (MD). A method for an Internet of Everything management device to automate customer service for a monitored device comprises collecting sensor data from a plurality of sensors, wherein the plurality of sensors comprises a first sensor that is not included in the MD, determining whether the MD is exhibiting abnormal behavior based on an analysis of the collected sensor data, and transmitting a report to a customer service entity associated with the MD in response to a determination that the MD is exhibiting abnormal behavior.
Abstract:
Disclosed are systems, apparatus, devices, methods, computer program products, and other implementations, including a method that includes determining location of a device, and controlling monitoring of behavior of one or more processes executing on the device based on the determined location of the device to identify potential one or more security-risky processes from the monitored one or more executing processes. In some embodiments, controlling the monitoring of the behavior of the one or more processes may include one or more of, for example, adjusting frequency of the monitoring of the one or more processes based on the determined location of the device, adjusting level of detail obtained for the monitored behavior of the one or more processes based on the determined location of the device, and/or adjusting features being observed for the monitored one or more processes based on the determined location of the device.
Abstract:
The various aspects provide a system and methods implemented on the system for generating a behavior model on a server that includes features specific to a mobile computing device and the device's current state/configuration. In the various aspects, the mobile computing device may send information identifying itself, its features, and its current state to the server. In response, the server may generate a device-specific lean classifier model for the mobile computing device based on the device's information and state and may send the device-specific lean classifier model to the device for use in detecting malicious behavior. The various aspects may enhance overall security and performance on the mobile computing device by leveraging the superior computing power and resources of the server to generate a device-specific lean classifier model that enables the device to monitor features that are actually present on the device for malicious behavior.
Abstract:
A method of obtaining and using access point signal information includes: receiving signals at a mobile device from a first set of access points during a passive measurement; and performing a first active measurement at the mobile device for the first set of the access points, including: sending at least one first communication each sent toward a respective one of the access points of the first set; and receiving at least one second communication each corresponding to, and responsive to, one of the at least one first communication and received from a corresponding one of the access points of the first set; where the passive measurement and the first active measurement is each performed repeatedly with the first set of the access points being reestablished at each repeat performance of the passive measurement, and with the passive measurement being performed less often than the first active measurement.
Abstract:
The subject matter disclosed herein relates to a system and method for determining indoor context information relating to a location of a mobile device. Indoor context information may be utilized by a mobile device or a network element to obtain an estimate of a location of the mobile device within an indoor environment.
Abstract:
The subject matter disclosed herein relates to a system and method for determining indoor context information relating to a location of a mobile device. Indoor context information may be utilized by a mobile device or a network element to obtain an estimate of a location of the mobile device within an indoor environment.