Devices and methods for classifying an execution session
US10452840B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Jul 14, 2016 |
| Grant date | Oct 22, 2019 |
| Priority date | — |
| Expiry date | Nov 6, 2036 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/2151
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Methods, systems and devices compute and use the execution session contexts of software applications to perform behavioral monitoring and analysis operations. A mobile device may be configured to monitor user activity and system activity of a software application, generate a shadow feature value that identifies actual execution session context of the software application during that activity, generate a behavior vector that incorporates context into the values describing behaviors, and determine whether the activity is malicious or benign based, at least in part, on the generated behavior vector. The mobile device processor may also be configured to intelligently determine whether the execution session context of a software application is relevant to determining whether any of the monitored mobile device behaviors are malicious or suspicious, and monitor only the execution session contexts of the software applications for which such determinations are relevant.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.