Devices and methods for classifying an execution session

    公开(公告)号:US10452840B2

    公开(公告)日:2019-10-22

    申请号:US15210815

    申请日:2016-07-14

    Abstract: Methods, systems and devices compute and use the execution session contexts of software applications to perform behavioral monitoring and analysis operations. A mobile device may be configured to monitor user activity and system activity of a software application, generate a shadow feature value that identifies actual execution session context of the software application during that activity, generate a behavior vector that incorporates context into the values describing behaviors, and determine whether the activity is malicious or benign based, at least in part, on the generated behavior vector. The mobile device processor may also be configured to intelligently determine whether the execution session context of a software application is relevant to determining whether any of the monitored mobile device behaviors are malicious or suspicious, and monitor only the execution session contexts of the software applications for which such determinations are relevant.

    Network attack detection using multi-path verification

    公开(公告)号:US10447717B2

    公开(公告)日:2019-10-15

    申请号:US15418693

    申请日:2017-01-28

    Abstract: Various embodiments provide methods, devices, and non-transitory processor-readable storage media enabling rogue access point detection with a communications device by sending multiple probes via different network connections to a remote server and receiving probe replies. Various embodiments may include a communication device transmitting a first probe addressed to a server via a first network connection and a second probe addressed to the server via a second network connection. Upon receiving a first probe reply from the server via the first network connection and a second probe reply from the server via the second network connection server, the communications device may analyze the received probe replies to determine whether an access point of either the first network or the second network is a rogue access point.

    Programmable Hardware Security Counters
    24.
    发明申请

    公开(公告)号:US20180107823A1

    公开(公告)日:2018-04-19

    申请号:US15432516

    申请日:2017-02-14

    CPC classification number: G06F21/52 G06F9/30098 G06F9/30145

    Abstract: Embodiments include computing devices and methods implemented by computing devices for using programmable hardware security counters for detecting malicious behavior. Various embodiments may include tracking the value of hardware instruction pointers, such as pointers tracking the memory address of each executing instruction. The computing device may identify a start and end of contiguous instruction segments using the tracked instruction pointer. For example, the computing device may analyze changes in value of the instruction pointer to detect “jumps” or large changes in the memory address of executing instructions. Based, at least in part, on the identified instruction segments, the computing device may determine whether the instruction segments represent malicious behavior. If the instruction segments represent malicious behavior, the computing device may terminate the requesting software application.

    Customized Network Traffic Models To Detect Application Anomalies
    25.
    发明申请
    Customized Network Traffic Models To Detect Application Anomalies 有权
    定制网络流量模型来检测应用程序异常

    公开(公告)号:US20160381057A1

    公开(公告)日:2016-12-29

    申请号:US14753666

    申请日:2015-06-29

    Abstract: Systems, methods, and devices of the various aspects enable identification of anomalous application behavior. A computing device processor may detect network communication activity of an application on the computing device. The processor may identify one or more device states of the computing device, and one or more categories of the application. The processor may determine whether the application is behaving anomalously based on a correlation of the detected network communication activity of the application, the identified one or more device states of the computing device, and the identified one or more categories of the application.

    Abstract translation: 各个方面的系统,方法和设备能够识别异常的应用行为。 计算设备处理器可以检测计算设备上的应用的网络通信活动。 处理器可以识别计算设备的一个或多个设备状态,以及应用的一个或多个类别。 处理器可以基于检测到的应用的网络通信活动,所识别的计算设备的一个或多个设备状态与所识别的一个或多个应用类别之间的相关性,来确定应用是否是异常行为。

    Methods and Systems for Behavior-Specific Actuation for Real-Time Whitelisting
    26.
    发明申请
    Methods and Systems for Behavior-Specific Actuation for Real-Time Whitelisting 审中-公开
    用于实时白名单的行为特定动作的方法和系统

    公开(公告)号:US20160337390A1

    公开(公告)日:2016-11-17

    申请号:US14849849

    申请日:2015-09-10

    Abstract: Various embodiments include methods of evaluating device behaviors in a computing device and enabling white listing of particular behaviors. Various embodiments may include monitoring activities of a software application operating on the computing device, and generating a behavior vector information structure that characterizes a first monitored activity of the software application. The behavior vector information structure may be applied to a machine learning classifier model to generate analysis results. The analysis results may be used to classify the first monitored activity of the software application as one of benign, suspicious, and non-benign. A prompt may be displayed to the user that requests that the user select whether to whitelist the software application in response to classifying the first monitored activity of the software application as suspicious or non-benign. The first monitored activity may be added to a whitelist of device behaviors in response to receiving a user input.

    Abstract translation: 各种实施例包括评估计算设备中的设备行为并实现特定行为的白名单的方法。 各种实施例可以包括在计算设备上操作的软件应用程序的监视活动,以及生成表征软件应用程序的第一监视活动的行为向量信息结构。 行为矢量信息结构可以应用于机器学习分类器模型,以生成分析结果。 分析结果可用于将软件应用程序的第一个监视活动分类为良性,可疑和非良性之一。 可以向用户显示提示,要求用户选择是否将软件应用程序的第一被监视活动分类为可疑或非良性,以便将软件应用程序列入白名单。 响应于接收到用户输入,第一个被监视的活动可以被添加到设备行为的白名单中。

    Method and apparatus for hierarchical map tiling
    28.
    发明授权
    Method and apparatus for hierarchical map tiling 有权
    分层地图拼接的方法和装置

    公开(公告)号:US09247379B2

    公开(公告)日:2016-01-26

    申请号:US14165386

    申请日:2014-01-27

    CPC classification number: H04W4/02 H04W4/021

    Abstract: A method for processing assistance data associated with positioning of a mobile device as described herein includes estimating an initial location of the mobile device within an area; designating the initial location of the mobile device as a focal point; retrieving a subset of hierarchical assistance data as a function of the focal point; and generating a multi-level assistance data structure for the area centered at the focal point.

    Abstract translation: 用于处理与本文所描述的移动设备的定位相关联的辅助数据的方法包括估计移动设备在一个区域内的初始位置; 指定移动设备的初始位置作为焦点; 检索作为焦点的函数的分层辅助数据的子集; 并为以焦点为中心的区域生成多级辅助数据结构。

    MOTION STATE BASED MOBILE DEVICE POSITIONING
    29.
    发明申请
    MOTION STATE BASED MOBILE DEVICE POSITIONING 有权
    基于运动状态的移动设备定位

    公开(公告)号:US20150148057A1

    公开(公告)日:2015-05-28

    申请号:US14089636

    申请日:2013-11-25

    Abstract: Various techniques are provided which may be implemented as methods, apparatuses and articles of manufacture for use by a mobile device or one or more computing devices to provide for or otherwise support motion state based mobile device positioning. In an example, a method may be implemented at a mobile device to identify two or more subsets of grid points corresponding to an electronic map representing a particular environment, select one of the two or more subsets of grid points for use in position estimation based, at least in part, on a motion state of the mobile device, and determine an estimated position of the mobile device based, at least in part, on the selected subset of grid points.

    Abstract translation: 提供的各种技术可以被实现为用于由移动设备或一个或多个计算设备用于提供或以其他方式支持基于运动状态的移动设备定位的方法,设备和制品。 在一个示例中,可以在移动设备处实现一种方法来识别对应于表示特定环境的电子地图的两个或更多个网格点子集,选择两个或更多个网格点子集中的一个以用于基于位置估计的位置估计, 至少部分地基于移动设备的运动状态,并且至少部分地基于所选择的网格点子集来确定移动设备的估计位置。

    Providing, organizing, and managing location history records of a mobile device

    公开(公告)号:US10368205B2

    公开(公告)日:2019-07-30

    申请号:US16274196

    申请日:2019-02-12

    Abstract: Methods and systems for providing information associated with a location history of a mobile device to one or more applications are disclosed. A mobile device generates one or more location history records based on one or more locations of the mobile device, each location history record comprising one or more points of interest and a duration at the one or more points of interest, receives an information request from at least one application, determines a subset of the one or more location history records that meet criteria from the information request, determines a level of permission for the at least one application based on the information request and the subset of the one or more location history records, and provides information associated with the subset of the one or more location history records to the at least one application based on the level of permission.

Patent Agency Ranking