Qualcomm Incorporated

Balbix, Inc.

Other

Vinay Sridhara

Rajarshi Gupta

Saumitra Mohan Das

Alok Aggarwal

Santosh Paul Abraham

Ayman Fawzy Naguib

Hemanth Sampath

Mihai Christodorescu

Yin Chen

Behrooz Khorashadi

Sai Pradeep Venkatraman

Weihua Gao

Mastooreh Salajegheh

Sameer Vermani

Sanjiv Nanda

Vincent Knowles Jones, Iv

Kassem Fawaz

Gaurav Banga

Payam Pakzad

Satyajit Prabhakar Patne

Faraz Mohammad Mirzaei

Sameera Poduri

Simone Merlin

Ravi Palanki

Leonid Sheynblat

Gengsheng Zhang

Lionel Jacques Garin

Hui Chao

Douglas Neal Rowitch

Alexander Gantman

Govindarajan Krishnamurthi

Srinivas Kandala

Sudha Anil Kumar Gathala

Vineet Kumar

Anil Gathala

Andres Valencia

Mona Mahmoudi

Man Ki Yoon

Xuetao Wei

George Cherian

Maarten Menzo Wentink

Arnaud Meylan

Alireza Raissinia

Carlos Horacio Aldana

Xiaoxin Zhang

Manoj Madhukar Deshpande

Bohuslav Rychlik

Ju-Yong Do

Ranjith Subramanian Jayaram

Sundar Raman

Geert Arnout Awater

Christopher Brunner

Nayeem Islam

Rolf De Vegt

Gheorghe Calin Cascaval

Edward Thomas Lingham Hardie

Vansh Pal Singh Makh

Dong Li

Soorgoli Ashok Halambi

Bernal A Arroyo

Patrick J Hughes

Sudha Anil Gathala

David Fiala

Norman Ko

Sendil Krishna

Josephine Pui Kwan Chu

Andrew C Blaich

Vered Bar Bracha

Vansh Makh

Aravind Raghava Iyengar

Sumanth Maram

Salyajit Prabhakar Patne

Faraz Mohammad-Mirzaei

Sina Firouzabadi

Manasi Deepak Navare

Vincent Knowles Jones

Vincent Knowles Iv Jones

Geert Awater

Programmatic mechanisms that enable the automatic assignment of categories to network entities based on observed evidence. Agents gather observation data that identifies observations made by agents about the network and a plurality of nodes of the network. The agents provide the observation data to a classification module, which assigns a device category to the nodes of the network based on the observation data and a probabilistic node model. The probabilistic node model considers several probabilities to ascertain a recommended device category for a particular node, such as probabilities based on a manufacturer of a node, an operating system executing on a node, information about other nodes in the local vicinity of a node, and an administrator web page associated with a node. The classification module may also assign a particular network category to the network based on the observation data and a probabilistic network model.

Device and network classification based on probabilistic model

Systems and methods are disclosed for automating customer service for a monitored device (MD). A method for an Internet of Everything management device to automate customer service for a monitored device comprises collecting sensor data from a plurality of sensors, wherein the plurality of sensors comprises a first sensor that is not included in the MD, determining whether the MD is exhibiting abnormal behavior based on an analysis of the collected sensor data, and transmitting a report to a customer service entity associated with the MD in response to a determination that the MD is exhibiting abnormal behavior.

Automating customer service an internet of everything environment

Methods and apparatus for reverse link acknowledgement in a wireless local area network. A method includes receiving, at a first node, a data communication over a common channel, the data communication being decodable by other nodes. The method also includes determining transmission resources from the data communication, wherein the transmission resources are different for each node, and transmitting a response over the common channel using the determined transmission resources. An apparatus includes a transmitter configured to transmit to a plurality of nodes a data communication over the common channel, and a receiver configured to receive responses from the plurality of nodes, wherein each response was sent using different transmission resources determined from the data communication.

Methods and apparatus for reverse link acknowledgement in a wireless local area network (WLAN)

Systems, methods, and devices of the various aspects enable detecting a malfunction caused by radio frequency (RF) interference. A computing device processor may identify a location of the computing device based on a plurality of real-time data inputs received by the computing device. The processor may characterize an RF environment of the computing device based on the identified location and the plurality of real-time data inputs. The processor may determine at least one RF emissions threshold based on the characterization of the RF environment. The processor may compare the characterization of the RF environment to the at least one RF emissions threshold, and may perform an action in response to determining that the characterization of the RF environment exceeds the at least one RF emissions threshold.

On-device behavioral analysis to detect malfunction due to RF interference

A method of disambiguating a location of a mobile station within a structure includes: obtaining, at the mobile station, regional pressure indications and corresponding region indications indicating regions within a structure that are vertically displaced with respect to each other, each of the regional pressure indications indicating atmospheric pressure information associated with the corresponding region; determining mobile station pressure information associated with a present location of the mobile station; comparing the mobile station pressure information with the regional pressure indications; and based on the comparing, determining in which of the regions the mobile station presently resides.

Multi-level location disambiguation

Methods, systems and devices compute and use the execution session contexts of software applications to perform behavioral monitoring and analysis operations. A mobile device may be configured to monitor user activity and system activity of a software application, generate a shadow feature value that identifies actual execution session context of the software application during that activity, generate a behavior vector that incorporates context into the values describing behaviors, and determine whether the activity is malicious or benign based, at least in part, on the generated behavior vector. The mobile device processor may also be configured to intelligently determine whether the execution session context of a software application is relevant to determining whether any of the monitored mobile device behaviors are malicious or suspicious, and monitor only the execution session contexts of the software applications for which such determinations are relevant.

Devices and methods for classifying an execution session

Approaches for analyzing risk of security breaches to a network. Agents gather, from multiple sources across the network, analysis data that identifies one or more habitable nodes and one or more opaque nodes. Habitable nodes each possess a computing environment conducive to installation of at least one of agent, while opaque nodes do not. An enterprise risk model is generated for the network using the analysis data. The enterprise risk model models a risk of security breaches to assets of the network from both authorized and unauthorized users of the network based on attributes of the habitable nodes and the opaque nodes of the network. The enterprise risk model may model both the present and the future risk to the enterprise, enabling, resources, such as time and money, to be best allocated in a scientific and methodical manner to improve the risk profile of the enterprise network.

Comprehensive modeling and mitigation of security risk vulnerabilities in an enterprise network

Approaches for enforcing security constraints against a network without impacting business workflows. A network is programmatically divided into a set of restrictive subnetworks without human intervention. One or more agents, executing on a plurality of nodes of the network, enforce security constraints by requiring a process, which requests access to an asset stored on a node of the network, to possess a security credential associated with a particular restrictive subnetwork to which the node belongs for access to the asset to be granted. The set of restrictive subnetworks may be determined based upon an enterprise risk model that models both the present and the future risk to the enterprise.

Mitigation of security risk vulnerabilities in an enterprise network

Approaches for modeling a risk of security breaches to a network. Agents gather, from multiple sources across the network, analysis data that identifies observed characteristics of habitable nodes and opaque nodes. Using the analysis data a multi-layer risk model for the network is generated that comprises a first layer that models an inherent risk of security breaches to assets of the network based on the observed characteristics. The model also comprises a second layer that models a present state of the inherent risk to the assets caused by global and temporal events. The model also comprises a third layer that models a change to the risk of security breaches in response to potential mitigative actions. The model may be used to understand how risk of a security breach is distributed and interdependent upon the nodes of the network so as to allow the most valuable preventive measures to be taken.

Risk modeling

The various aspects configure a mobile computing device to efficiently identify, classify, model, prevent, and/or correct the conditions and/or behaviors occurring on the mobile computing device that are related to one or more peripheral devices connected to the mobile computing device and that often degrade the performance and/or power utilization levels of the mobile computing device over time. In the various aspects, the mobile computing device may obtain a classifier model that includes, tests, and/or evaluates various conditions, features, behaviors and corrective actions on the mobile computing device that are related to one or more peripheral devices connected to the mobile computing device. The mobile computing device may utilize the classifier model to quickly identify and correct undesirable behaviors occurring on the mobile computing device that are related to the one or more connected peripheral devices.

Behavioral analysis for securing peripheral devices

Various embodiments include methods of evaluating device behaviors in a computing device and enabling white listing of particular behaviors. Various embodiments may include monitoring activities of a software application operating on the computing device, and generating a behavior vector information structure that characterizes a first monitored activity of the software application. The behavior vector information structure may be applied to a machine learning classifier model to generate analysis results. The analysis results may be used to classify the first monitored activity of the software application as one of benign, suspicious, and non-benign. A prompt may be displayed to the user that requests that the user select whether to whitelist the software application in response to classifying the first monitored activity of the software application as suspicious or non-benign. The first monitored activity may be added to a whitelist of device behaviors in response to receiving a user input.

Methods and systems for behavior-specific actuation for real-time whitelisting

The various aspects provide a method for recognizing and preventing malicious behavior on a mobile computing device before it occurs by monitoring and modifying instructions pending in the mobile computing device's hardware pipeline (i.e., queued instructions). In the various aspects, a mobile computing device may preemptively determine whether executing a set of queued instructions will result in a malicious configuration given the mobile computing device's current configuration. When the mobile computing device determines that executing the queued instructions will result in a malicious configuration, the mobile computing device may stop execution of the queued instructions or take other actions to preempt the malicious behavior before the queued instructions are executed.

Malware detection and prevention by monitoring and modifying a hardware pipeline

Methods and systems for classifying mobile device behavior include generating a full classifier model that includes a finite state machine suitable for conversion into boosted decision stumps and/or which describes all or many of the features relevant to determining whether a mobile device behavior is benign or contributing to the mobile device's degradation over time. A mobile device may receive the full classifier model along with sigmoid parameters and use the model to generate a full set of boosted decision stumps from which a more focused or lean classifier model is generated by culling the full set to a subset suitable for efficiently determining whether mobile device behavior are benign. Results of applying the focused or lean classifier model may be normalized using a sigmoid function, with the resulting normalized result used to determine whether the behavior is benign or non-benign.

Using normalized confidence values for classifying mobile device behaviors

Methods, and devices implementing the methods, use device-specific classifiers in a privacy-preserving behavioral monitoring and analysis system for crowd-sourcing of device behaviors. Diverse devices having varying degrees of 'smart' capabilities may monitor operational behaviors. Gathered operational behavior information may be transmitted to a nearby device having greater processing capabilities than a respective collecting device, or may be transmitted directly to an 'always on' device. The behavior information may be used to generate behavior vectors, which may be analyzed for anomalies. Vectors containing anomaly flags may be anonymized to remove any user-identifying information and subsequently transmitted to a remote recipient such as a service provider or device manufacture. In this manner, operational behavior information may be gathered about different devices from a large number of users, to obtain statistical analysis of operational behavior for specific makes and models of devices, without divulging personal information about device users.

Methods and systems for automated anonymous crowdsourcing of characterized device behaviors

Methods, devices, systems, and non-transitory process-readable storage media for a computing device to use machine learning to dynamically configure an application and/or complex algorithms associated with the application. An aspect method performed by a processor of the computing device may include operations for performing an application that calls a library function associated with a complex algorithm, obtaining signals indicating user responses to performance of the application, determining whether a user tolerates the performance of the application based on the obtained signals indicating the user responses, adjusting a configuration of the application to improve a subsequent performance of the application in response to determining the user does not tolerate the performance of the application, and storing data indicating the user responses to the performance of the application and other external variables for use in subsequent evaluations of user inputs.

Application characterization for machine learning on heterogeneous core devices

Growing community of inventors

Santa Clara, CA, United States of America

Vinay Sridhara