Abstract:
Methods, systems and devices compute and use the execution session contexts of software applications to perform behavioral monitoring and analysis operations. A mobile device may be configured to monitor user activity and system activity of a software application, generate a shadow feature value that identifies actual execution session context of the software application during that activity, generate a behavior vector that incorporates context into the values describing behaviors, and determine whether the activity is malicious or benign based, at least in part, on the generated behavior vector. The mobile device processor may also be configured to intelligently determine whether the execution session context of a software application is relevant to determining whether any of the monitored mobile device behaviors are malicious or suspicious, and monitor only the execution session contexts of the software applications for which such determinations are relevant.
Abstract:
Various embodiments provide methods, devices, and non-transitory processor-readable storage media enabling rogue access point detection with a communications device by sending multiple probes via different network connections to a remote server and receiving probe replies. Various embodiments may include a communication device transmitting a first probe addressed to a server via a first network connection and a second probe addressed to the server via a second network connection. Upon receiving a first probe reply from the server via the first network connection and a second probe reply from the server via the second network connection server, the communications device may analyze the received probe replies to determine whether an access point of either the first network or the second network is a rogue access point.
Abstract:
Systems, apparatus and methods for selecting a base station or a set of base stations for RTT measurements, or other interactive radio localization technique, to determine a position fix of a device are presented. The method imposes a processing load on only inactive or less active base stations. Busy or busier base stations are not used in the interactive radio localization technique. By imposing a processing load on only less active base stations, transmitting devices may be under loaded and encounter a more uniform processing delay, and thus provide a more accurate measurement resulting in a more accurate position fix.
Abstract:
Embodiments include computing devices and methods implemented by computing devices for using programmable hardware security counters for detecting malicious behavior. Various embodiments may include tracking the value of hardware instruction pointers, such as pointers tracking the memory address of each executing instruction. The computing device may identify a start and end of contiguous instruction segments using the tracked instruction pointer. For example, the computing device may analyze changes in value of the instruction pointer to detect “jumps” or large changes in the memory address of executing instructions. Based, at least in part, on the identified instruction segments, the computing device may determine whether the instruction segments represent malicious behavior. If the instruction segments represent malicious behavior, the computing device may terminate the requesting software application.
Abstract:
Systems, methods, and devices of the various aspects enable identification of anomalous application behavior. A computing device processor may detect network communication activity of an application on the computing device. The processor may identify one or more device states of the computing device, and one or more categories of the application. The processor may determine whether the application is behaving anomalously based on a correlation of the detected network communication activity of the application, the identified one or more device states of the computing device, and the identified one or more categories of the application.
Abstract:
Various embodiments include methods of evaluating device behaviors in a computing device and enabling white listing of particular behaviors. Various embodiments may include monitoring activities of a software application operating on the computing device, and generating a behavior vector information structure that characterizes a first monitored activity of the software application. The behavior vector information structure may be applied to a machine learning classifier model to generate analysis results. The analysis results may be used to classify the first monitored activity of the software application as one of benign, suspicious, and non-benign. A prompt may be displayed to the user that requests that the user select whether to whitelist the software application in response to classifying the first monitored activity of the software application as suspicious or non-benign. The first monitored activity may be added to a whitelist of device behaviors in response to receiving a user input.
Abstract:
The disclosure is directed to determining whether or not a mobile device is indoors. The mobile device obtains a position fix based, at least in part, on an outdoor positioning system, and obtains one or more shape-files for one or more objects that are in proximity of the position fix.
Abstract:
A method for processing assistance data associated with positioning of a mobile device as described herein includes estimating an initial location of the mobile device within an area; designating the initial location of the mobile device as a focal point; retrieving a subset of hierarchical assistance data as a function of the focal point; and generating a multi-level assistance data structure for the area centered at the focal point.
Abstract:
Various techniques are provided which may be implemented as methods, apparatuses and articles of manufacture for use by a mobile device or one or more computing devices to provide for or otherwise support motion state based mobile device positioning. In an example, a method may be implemented at a mobile device to identify two or more subsets of grid points corresponding to an electronic map representing a particular environment, select one of the two or more subsets of grid points for use in position estimation based, at least in part, on a motion state of the mobile device, and determine an estimated position of the mobile device based, at least in part, on the selected subset of grid points.
Abstract:
Methods and systems for providing information associated with a location history of a mobile device to one or more applications are disclosed. A mobile device generates one or more location history records based on one or more locations of the mobile device, each location history record comprising one or more points of interest and a duration at the one or more points of interest, receives an information request from at least one application, determines a subset of the one or more location history records that meet criteria from the information request, determines a level of permission for the at least one application based on the information request and the subset of the one or more location history records, and provides information associated with the subset of the one or more location history records to the at least one application based on the level of permission.