Qualcomm Incorporated

Yin Chen

Saumitra Mohan Das

Vinay Sridhara

Hui Chao

Rajarshi Gupta

Payam Pakzad

Ayman Fawzy Naguib

Mastooreh Salajegheh

Vrajesh Rajesh Bhavsar

Man Ki Yoon

Ravi Palanki

Ramin Samadani

Mihai Christodorescu

Seyed Ali Ahmadzadeh

Jiajian Chen

Dong Li

Eric K Holm

Kassem Fawaz

Andres Valencia

Sriram Nandha Premnath

Mona Mahmoudi

Methods and systems for providing information associated with a location history of a mobile device to one or more applications are disclosed. A mobile device generates one or more location history records based on one or more locations of the mobile device, each location history record comprising one or more points of interest and a duration at the one or more points of interest, receives an information request from at least one application, determines a subset of the one or more location history records that meet criteria from the information request, determines a level of permission for the at least one application based on the information request and the subset of the one or more location history records, and provides information associated with the subset of the one or more location history records to the at least one application based on the level of permission.

Providing, organizing, and managing location history records of a mobile device

Methods, systems and devices compute and use the execution session contexts of software applications to perform behavioral monitoring and analysis operations. A mobile device may be configured to monitor user activity and system activity of a software application, generate a shadow feature value that identifies actual execution session context of the software application during that activity, generate a behavior vector that incorporates context into the values describing behaviors, and determine whether the activity is malicious or benign based, at least in part, on the generated behavior vector. The mobile device processor may also be configured to intelligently determine whether the execution session context of a software application is relevant to determining whether any of the monitored mobile device behaviors are malicious or suspicious, and monitor only the execution session contexts of the software applications for which such determinations are relevant.

Devices and methods for classifying an execution session

Various embodiments provide methods, devices, and non-transitory processor-readable storage media enabling rogue access point detection with a communications device by sending multiple probes via different network connections to a remote server and receiving probe replies. Various embodiments may include a communication device transmitting a first probe addressed to a server via a first network connection and a second probe addressed to the server via a second network connection. Upon receiving a first probe reply from the server via the first network connection and a second probe reply from the server via the second network connection server, the communications device may analyze the received probe replies to determine whether an access point of either the first network or the second network is a rogue access point.

Network attack detection using multi-path verification

Systems, apparatus and methods for selecting a base station or a set of base stations for RTT measurements, or other interactive radio localization technique, to determine a position fix of a device are presented. The method imposes a processing load on only inactive or less active base stations. Busy or busier base stations are not used in the interactive radio localization technique. By imposing a processing load on only less active base stations, transmitting devices may be under loaded and encounter a more uniform processing delay, and thus provide a more accurate measurement resulting in a more accurate position fix.

Base station selection for positioning/localization based on an indication of capacity

Methods, systems, computer-readable media, and apparatuses for determining a position indicator are presented. In some embodiments, position data indicating a position of a mobile device is obtained. A position indicator is determined based on at least one region of a map. The position of the mobile device is located within the at least one region. The position indicator indicates a map-feature-dependent region of the map. The position indicator is provided.

Adaptive position indicator

Various embodiments include methods of evaluating device behaviors in a computing device and enabling white listing of particular behaviors. Various embodiments may include monitoring activities of a software application operating on the computing device, and generating a behavior vector information structure that characterizes a first monitored activity of the software application. The behavior vector information structure may be applied to a machine learning classifier model to generate analysis results. The analysis results may be used to classify the first monitored activity of the software application as one of benign, suspicious, and non-benign. A prompt may be displayed to the user that requests that the user select whether to whitelist the software application in response to classifying the first monitored activity of the software application as suspicious or non-benign. The first monitored activity may be added to a whitelist of device behaviors in response to receiving a user input.

Methods and systems for behavior-specific actuation for real-time whitelisting

Methods and systems for classifying mobile device behavior include generating a full classifier model that includes a finite state machine suitable for conversion into boosted decision stumps and/or which describes all or many of the features relevant to determining whether a mobile device behavior is benign or contributing to the mobile device's degradation over time. A mobile device may receive the full classifier model along with sigmoid parameters and use the model to generate a full set of boosted decision stumps from which a more focused or lean classifier model is generated by culling the full set to a subset suitable for efficiently determining whether mobile device behavior are benign. Results of applying the focused or lean classifier model may be normalized using a sigmoid function, with the resulting normalized result used to determine whether the behavior is benign or non-benign.

Using normalized confidence values for classifying mobile device behaviors

Systems, methods, and devices of the various aspects enable identification of anomalous application behavior. A computing device processor may detect network communication activity of an application on the computing device. The processor may identify one or more device states of the computing device, and one or more categories of the application. The processor may determine whether the application is behaving anomalously based on a correlation of the detected network communication activity of the application, the identified one or more device states of the computing device, and the identified one or more categories of the application.

Customized network traffic models to detect application anomalies

Implementations include systems and methods for managing security for a mobile communication device. In implementations, a processor of the mobile communication device may determine environment context information. The processor may receive safety information from one or more peer devices. The processor may determine an authentication requirement for the mobile communication device based on the received safety information and the determined environment context information. The processor may deny access to a function of the mobile communication device in response to determining that the determined authentication requirement is not satisfied.

Managing security for a mobile communication device

Various aspects include methods and computing devices implementing the methods for evaluating device behaviors in the computing devices. Aspect methods may include using a behavior-based machine learning technique to classify a device behavior as one of benign, suspicious, and non-benign. Aspect methods may include using one of a multi-label classification and a meta-classification technique to sub-classify the device behavior into one or more sub-categories. Aspect methods may include determining a relative importance of the device behavior based on the sub-classification, and determining whether to perform robust behavior-based operations based on the determined relative importance of the device behavior.

Methods and systems for on-device high-granularity classification of device behaviors using multi-label models

A computing device processor may be configured with processor-executable instructions to implement methods of detecting and responding to fake user interaction (UI) events. The processor may determine whether a user interaction event is a fake user interaction event by analyzing raw data generated by one or more hardware drivers in conjunction with user interaction event information generated or received by the high-level operating system. In addition, the processor may be configured with processor-executable instructions to implement methods of using behavioral analysis and machine learning techniques to identify, prevent, correct, or otherwise respond to malicious or performance-degrading behaviors of the computing device based on whether a detected user interaction event is an authentic or fake user interaction event.

Growing community of inventors

Campbell, CA, United States of America

Yin Chen