Abstract:
The various aspects include systems and methods for enabling mobile computing devices to recognize when they are at risk of experiencing malicious behavior in the near future given a current configuration. Thus, the various aspects enable mobile computing devices to anticipate malicious behaviors before a malicious behavior begins rather than after the malicious behavior has begun. In the various aspects, a network server may receive behavior vector information from multiple mobile computing devices and apply pattern recognition techniques to the received behavior vector information to identify malicious configurations and pathway configurations that may lead to identified malicious configurations. The network server may inform mobile computing devices of identified malicious configurations and the corresponding pathway configurations, thereby enabling mobile computing devices to anticipate and prevent malicious behavior from beginning by recognizing when they have entered a pathway configuration leading to malicious behavior.
Abstract:
Systems, apparatus and methods for determining a cyclic shift delay (CSD) mode from a plurality of CSD modes is disclosed. A received OFDM signal is converted to a channel impulse response (CIR) signal in the time domain and/or a channel frequency response (CFR) signal in the frequency domain. Matched filters and a comparator are used to determine a most likely current CSD mode. Alternatively, a classifier is used with a number of inputs including outputs from two or more matched filters and one or more outputs from a feature extractor. The feature extractor extracts features in the time domain from the CIR signal and/or in the frequency domain from the CFR signal useful in distinguishing various CSD modes.
Abstract:
Methods, devices and systems for detecting suspicious or performance-degrading mobile device behaviors intelligently, dynamically, and/or adaptively determine computing device behaviors that are to be observed, the number of behaviors that are to be observed, and the level of detail or granularity at which the mobile device behaviors are to be observed. The various aspects efficiently identify suspicious or performance-degrading mobile device behaviors without requiring an excessive amount of processing, memory, or energy resources.
Abstract:
Systems, methods, and devices of the various aspects enable detecting anomalous electromagnetic (EM) emissions from among a plurality of electronic devices. A device processor may receive EM emissions of a plurality of electronic devices, wherein the receiving device has no previous information about any of the plurality of electronic devices. The device processor may cross-correlate the EM emissions of the plurality of electronic devices over time. The device processor may identify a difference of the cross-correlated EM emissions from earlier cross-correlated EM emissions. The device processor may determine that the difference of the cross-correlated EM emissions from the earlier cross-correlated EM emissions indicates an anomaly in one or more of the plurality of electronic devices.
Abstract:
Various aspects include methods and computing devices implementing the methods for evaluating device behaviors in the computing devices. Aspect methods may include using a behavior-based machine learning technique to classify a device behavior as one of benign, suspicious, and non-benign. Aspect methods may include using one of a multi-label classification and a meta-classification technique to sub-classify the device behavior into one or more sub-categories. Aspect methods may include determining a relative importance of the device behavior based on the sub-classification, and determining whether to perform robust behavior-based operations based on the determined relative importance of the device behavior.
Abstract:
Described are devices, methods, techniques and systems for locating a portable services access transceiver (PSAT) for use in aiding emergency “911” services. In one implementation, one or more conditions indicative of movement of a PSAT may initiate a process for obtaining a new estimated location of the PSAT. In another implementation, a location of a PSAT may be determined or updated using indoor navigation techniques.
Abstract:
Methods, systems and devices for generating data models in a communication system may include applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors. Such behavior vectors may be used to compute a weight value for one or more nodes of the boosted decision tree. Classifier models factors having a high probably of determining whether a mobile device behavior is benign or not benign based on the computed weight values may be identified. Computing weight values for boosted decision tree nodes may include computing an exclusive answer ratio for generated boosted decision tree nodes. The identified factors may be applied to the corpus of behavior vectors to generate a second family of classifier models identifying fewer factors and data points relevant for enabling the mobile device to determine whether a behavior is benign or not benign.
Abstract:
According to some aspects, a method includes communicating a request from a first device to a second device using near field communication (NFC). The request includes a preferred mode of wireless local area network (Wi-Fi) operation and state information of the first device. The method further includes receiving a reply at the first device, sent from the second device, including acceptance of the preferred mode of Wi-Fi operation. The method further includes communicating wireless information to establish the Wi-Fi communication link from the first device to the second device.
Abstract:
Methods, systems and devices use operating system execution states while monitoring applications executing on a mobile device to perform comprehensive behavioral monitoring and analysis include configuring a mobile device to monitor an activity of a software application, generate a shadow feature value that identifies an operating system execution state of the software application during that activity, generate a behavior vector that associates the monitored activity with the shadow feature value, and determine whether the activity is malicious or benign based on the generated behavior vector, shadow feature value and/or operating system execution states. The mobile device may also be configured to intelligently determine whether the operating system execution state of a software application is relevant to determining whether any of the monitored mobile device behaviors are malicious or suspicious, and monitor only the operating system execution states of the software applications for which such determinations are relevant.
Abstract:
In one implementation, a method may comprise: storing a user profile indicative of at least one attribute of a user of a mobile station; determining a measurement value based, at least in part, on a signal from at least one sensor on the mobile station; and estimating a location of the mobile station based, at least in part, on an association of the at least one attribute and the measurement value with a context parameter map database.