Abstract:
Methods, systems, computer-readable media, and apparatuses for determining a position indicator are presented. In some embodiments, position data indicating a position of a mobile device is obtained. A position indicator is determined based on at least one region of a map. The position of the mobile device is located within the at least one region. The position indicator indicates a map-feature-dependent region of the map. The position indicator is provided.
Abstract:
Systems, apparatus and methods for selecting a base station or a set of base stations for RTT measurements, or other interactive radio localization technique, to determine a position fix of a device are presented. The method imposes a processing load on only inactive or less active base stations. Busy or busier base stations are not used in the interactive radio localization technique. By imposing a processing load on only less active base stations, transmitting devices may be under loaded and encounter a more uniform processing delay, and thus provide a more accurate measurement resulting in a more accurate position fix.
Abstract:
A computing device processor may be configured with processor-executable instructions to implement methods of using behavioral analysis and machine learning techniques to evaluate the collective behavior of two or more software applications operating on the device. The processor may be configured to monitor the activities of a plurality of software applications operating on the device, collect behavior information for each monitored activity, generate a behavior vector based on the collected behavior information, apply the generated behavior vector to a classifier model to generate analysis information, and use the analysis information to classify a collective behavior of the plurality of software applications.
Abstract:
A computing device processor may be configured with processor-executable instructions to implement methods of using behavioral analysis and machine learning techniques to identify, prevent, correct, or otherwise respond to malicious or performance-degrading behaviors of the computing device. As part of these operations, the processor may generate user-persona information that characterizes the user based on that user's activities, preferences, age, occupation, habits, moods, emotional states, personality, device usage patterns, etc. The processor may use the user-persona information to dynamically determine the number of device features that are monitored or evaluated in the computing device, to identify the device features that are most relevant to determining whether the device behavior is not consistent with a pattern of ordinary usage of the computing device by the user, and to better identify or respond to non-benign behaviors of the computing device.
Abstract:
A computing device processor may be configured with processor-executable instructions to implement methods of detecting and responding non-benign behaviors of the computing device. The processor may be configured to monitor device behaviors to collect behavior information, generate a behavior vector information structure based on the collected behavior information, apply the behavior vector information structure to a classifier model to generate analysis results, use the analysis results to classify a behavior of the device, use the analysis results to determine the features evaluated by the classifier model that contributed most to the classification of the behavior, and select the top “n” (e.g., 3) features that contributed most to the classification of the behavior. The computing device may display the selected features on an electronic display of the computing device.
Abstract:
A computing device processor may be configured with processor-executable instructions to implement methods that include using expectation-maximization (EM) machine learning techniques to continuously, repeatedly, or recursively generate, train, improve, focus, or refine the machine learning classifier models that are used by a behavior-based monitoring and analysis system (or behavior-based security system) of the computing device to better identify and respond to various conditions or behaviors that may have a negative impact on its performance, power utilization levels, network usage levels, security and/or privacy over time.
Abstract:
Methods and devices for tracking data flows in a computing device include monitoring memory in a hardware component of the computing device to identify a read operation that reads information from a tainted memory address, using heuristics to identify a first, second, and third number of operations performed after the identified read operation, marking memory addresses of write operations performed after first number of operations and before the second number of operations as tainted, and marking memory addresses of write operations performed after the third number of operations and before the second number of operations as untainted.
Abstract:
A computing device processor may be configured with processor-executable instructions to implement methods of detecting and responding to fake user interaction (UI) events. The processor may determine whether a user interaction event is a fake user interaction event by analyzing raw data generated by one or more hardware drivers in conjunction with user interaction event information generated or received by the high-level operating system. In addition, the processor may be configured with processor-executable instructions to implement methods of using behavioral analysis and machine learning techniques to identify, prevent, correct, or otherwise respond to malicious or performance-degrading behaviors of the computing device based on whether a detected user interaction event is an authentic or fake user interaction event.
Abstract:
Methods and devices for tracking data flows in a computing device include monitoring memory in a hardware component of the computing device to identify a read operation that reads information from a tainted memory address, using heuristics to identify a first, second, and third number of operations performed after the identified read operation, marking memory addresses of write operations performed after first number of operations and before the second number of operations as tainted, and marking memory addresses of write operations performed after the third number of operations and before the second number of operations as untainted.
Abstract:
Methods, systems, computer-readable media, and apparatuses for reducing a set of access points to be used for mobile device positioning are presented. In some embodiments, a subset of access points may be selected from a set of access points. A trial set of access points may be generated by removing the subset of access points from the set of access points. A coverage quality may be determined for the trial set of access points. In response to determining that the coverage quality of the trial set of access points exceeds a threshold coverage quality, the subset of access points may be removed from the set of access points.