CN107924492A - Classified using normalization the value of the confidence to mobile equipment behavior - Google Patents
Classified using normalization the value of the confidence to mobile equipment behavior Download PDFInfo
- Publication number
- CN107924492A CN107924492A CN201680047561.4A CN201680047561A CN107924492A CN 107924492 A CN107924492 A CN 107924492A CN 201680047561 A CN201680047561 A CN 201680047561A CN 107924492 A CN107924492 A CN 107924492A
- Authority
- CN
- China
- Prior art keywords
- lean
- behavior
- model
- computing device
- decision tree
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N5/00—Computing arrangements using knowledge-based models
- G06N5/04—Inference or reasoning models
- G06N5/043—Distributed expert systems; Blackboards
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N5/00—Computing arrangements using knowledge-based models
- G06N5/02—Knowledge representation; Symbolic representation
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N5/00—Computing arrangements using knowledge-based models
- G06N5/02—Knowledge representation; Symbolic representation
- G06N5/022—Knowledge engineering; Knowledge acquisition
- G06N5/025—Extracting rules from data
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Evolutionary Computation (AREA)
- Computing Systems (AREA)
- Data Mining & Analysis (AREA)
- Mathematical Physics (AREA)
- Artificial Intelligence (AREA)
- Computational Linguistics (AREA)
- Computer Security & Cryptography (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Medical Informatics (AREA)
- Computer Hardware Design (AREA)
- Debugging And Monitoring (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
Method and system for classifying to mobile equipment behavior includes generation Complete Classification device model, and it is finite state machine that is benign or facilitating the whole or many features the mobile equipment feature related with the degradation of time that it, which is included suitable for being converted into lifting decision tree and/or its description with determining mobile equipment behavior,.Mobile equipment can receive Complete Classification device model together with S-shaped parameter, and the complete set of lifting decision tree is generated using the model, according to it by that set will reject to arrive and be suitable for effectively determining whether movement equipment behavior is benign and generate sorter model more concentrate or lean completely.It can be normalized using the result of concentration or lean sorter model using sigmoid function, wherein obtained normalization result is used to determine that behavior is benign or non-benign.
Description
Related application
The application is entitled " the Methods and Systems of Using Boosted submitted on November 26th, 2013
Decision Stumps and Joint Feature Selection and Pruning Algorithms for the
The U.S. Patent Application No. 14/090 of Efficient Classification of Mobile Device Behaviors ",
The part continuation application of No. 261, it requires entitled " the Methods and Systems of submitted for 5th in September in 2013
Using Boosted Decision Stumps and Joint Feature Selection and Pruning
The U.S. of Algorithms for the Efficient Classification of Mobile Device Behaviors "
Provisional application the 61/874,129th, entitled " the On-Device Real-Time Behavior submitted on January 2nd, 2013
The U.S. Provisional Patent Application of Analyzer " the 61/748,217th and submitted on January 2nd, 2013 entitled
" the U.S. Provisional Patent Application of Architecture for Client-Cloud Behavior Behavior Analyzer "
The rights and interests of the priority of the 61/748th, No. 220, all these full contents are incorporated herein by reference.
Background technology
Honeycomb and wireless communication technique have gone through explosive growth in the past few years.More preferable communication, hardware,
The network of bigger and more reliable agreement have promoted this growth.Therefore, wireless service provider can be their visitor now
Family provides the unprecedented level of access to information, resource and communication.
In order to run neck and neck with these services, mobile electronic device is (for example, cell phone, tablet PC, meter on knee
Calculation machine etc.) become than more powerful in the past and complicated.This complexity for Malware, software conflict, hardware fault and its
Its similar mistake or phenomenon create new chance, and the long-term and duration performance and utilization of power to mobile equipment are horizontal to be produced
Negative effect.Therefore, identification and correction may negatively affect mobile equipment long-term and duration performance and utilization of power it is horizontal
Condition and/or mobile equipment behavior are beneficial to consumer.
The content of the invention
Various aspects include the method for generating lean behavior sorter model in a mobile device, and this method can include:
Being received in the processor of mobile equipment includes the Complete Classification device model of finite state machine;And use Complete Classification device model
To generate the lean sorter model in mobile equipment.Finite state machine can include suitable for conversion or be expressed as multiple liftings
Each lifting decision tree in the information of decision tree, and lifting decision tree can include test condition and weighted value.In a side
The behavior of mobile equipment is categorized as benign by face, the lean sorter model that this method can also be included the use of in mobile equipment
Or non-benign (i.e. malice, performance degradation etc.).
In one aspect, the lean sorter model being generated based on the Complete Classification device model can include:Will
The list of lifting decision tree is converted in the finite state machine that Complete Classification device model includes, and based in lifting decision tree
The list lifting decision tree that includes generate lean sorter model.
On the one hand, can also be included to generate lean sorter model based on the Complete Classification device model:Determining should
When evaluated excessive process resource, memory money to classify to the equipment behavior without the consumption computing device
Source or multiple unique test conditions of energy resource;By sequentially traverse through it is described lifting decision tree list, and will with it is every
The test condition that the lifting decision tree of a order traversal is associated is inserted into the list of the test condition, until the test
Untill the list of condition includes the multiple unique test condition, to generate the list of test condition;And the generation lean
Sorter model is surveyed with one only including test in multiple test conditions that the list of the test condition generated includes
Those lifting decision trees of strip part.
On the one hand, the method may include the lean sorter model used in mobile equipment, with by that will collect
To behavioural information be applied to each lifting decision tree in lean sorter model, calculate the behavioural information application that will be collected into
The weighted average of the result of each lifting decision tree in lean sorter model, and weighted average and threshold value are carried out
Compare, the behavior of mobile equipment is categorized as benign or non-benign.
On the one hand, the lean sorter model being generated based on the Complete Classification device model can include:Will be
The finite state machine that Complete Classification device model includes is converted to the list of lifting decision tree;And based in lifting decision tree row
The lifting decision tree that table includes, generation lean sorter model race, the lean sorter model race include lean grader
Model and multiple extra lean sorter models, each lean classification in the multiple extra lean sorter model
Device model includes unique test condition of varying number.
On the one hand, generating lean sorter model can include generating multiple lean sorter models, each lean point
Class device model includes the use of different weighted values and different threshold values to test the decision tree of first condition.On the one hand, should
Method can include recalculating multiple lean grader moulds with generating in a mobile device based on Complete Classification device model
The threshold value that lifting decision tree in type is associated.On the one hand, this method can include based on Complete Classification device model come weight
It is new to calculate the weighted value associated with the lifting decision tree in the multiple lean sorter models generated in a mobile device.
On the one hand, this method can include generating Complete Classification device model in the server by following operation:
The corpus of the information on mobile equipment behavior, and the language based on the information on mobile equipment behavior are received in server
Material storehouse includes being suitable for being converted to multiple data for lifting decision trees to generate finite state machine, and finite state machine is sent
To mobile equipment as Complete Classification device model.On the one hand, each test condition in multiple test conditions is with identifying it
Associated test condition by cause mobile equipment can determine mobile equipment behavior whether be benign possibility probable value
Associated, the method is additionally included in is sent to mobile equipment before based on general using finite state machine as Complete Classification device model
Rate value carrys out the tissue lifting decision tree in finite state machine.
On the other hand, this method can include the use of S-shaped parameter to calculate and using classifying for improved behavior
The value of the confidence is normalized, it, which can be included in the processor of computing device from server, receives Complete Classification device model and S-shaped ginseng
Number, normalization the value of the confidence is determined based on the S-shaped parameter, and based on the normalization the value of the confidence come to the computing device
The equipment behavior classify.
On the one hand, this method can include by the way that the finite state machine included in Complete Classification device model is converted into
Lifting decision tree lifts the list of decision tree to generate, and based on the lifting decision tree included in the list for lifting decision tree
To generate lean sorter model race, wherein being classified based on normalization the value of the confidence to the equipment behavior of the computing device
Including:Behavior vector information structure is applied to the first lean sorter model in the lean sorter model race to generate
Analysis result, and determine whether second be applied to the behavior vector information structure in the lean sorter model race
Lean sorter model, to generate new analysis result based on the normalization the value of the confidence.
On the other hand, this method can include generating the lean grader mould based on the Complete Classification device model
Type, and can be included to carry out classification to the equipment behavior of the computing device based on normalization the value of the confidence:By behavior vector
Message structure generates analysis as a result, and being determined using analysis result and normalization the value of the confidence applied to lean sorter model
Equipment behavior is benign or non-benign.In another aspect, the essence is generated based on the Complete Classification device model
Beneficial sorter model can include:The list of test condition is generated by following operation:Will be in the Complete Classification device model
The finite state machine included is converted into multiple lifting decision trees to generate the list of lifting decision tree, it is determined that it is evaluated with
Classify equipment behavior the multiple of the excessive process resource without consumption calculations equipment, memory resource or energy resource
Unique test condition, by sequentially traversing through the list of lifting decision tree, and by the lifting decision tree with each order traversal
Associated test condition is inserted into the list of the test condition, until the list of the test condition is including the multiple
Untill unique test condition;And the generation lean sorter model is with only including testing in the list of the test condition
Including multiple test conditions in a test condition those lifting decision trees.
On the other hand, by the behavior vector information structure be applied to the lean sorter model by determine it is described in terms of
Whether the equipment behavior for calculating equipment is that non-benign can include:It is collected into what is included in the behavior vector information structure
Behavioural information be applied in multiple lifting decision trees that the lean sorter model includes each lifting decision-making
Tree;Calculate and the multiple lifting that the behavioural information being collected into is applied to include in the lean sorter model is determined
The weighted average of the result of each lifting decision tree in plan tree;And by the weighted average compared with threshold value.
It yet still another aspect, the method may include generate the S-shaped parameter of renewal based on the normalization the value of the confidence;With
And the S-shaped parameter of the renewal is sent to the server computing device.On the other hand, the method may include:From
The server computing device receives the S-shaped parameter of renewal;Based on the renewal received from the server computing device
S-shaped parameter, to determine new normalization the value of the confidence;And based on the new normalization the value of the confidence, to be set to the calculating
The standby equipment behavior is classified.On the other hand, receiving the Complete Classification device model and the S-shaped parameter can wrap
Reception finite state machine is included, the finite state machine includes being suitable for the information for being expressed as two or more lifting decision trees,
Each lifting decision tree includes weighted value and test condition, and the test condition is with identifying that the test condition will cause the meter
Calculate equipment and can determine that the equipment behavior of the computing device is the probable value phase of one of benign and non-benign possibility
Association.
In addition aspect can include a kind of computing device, it includes:Divide completely for being received from server computing device
The unit of class device model and S-shaped parameter;For determining the unit of normalization the value of the confidence based on the S-shaped parameter;And it is used for
Based on the normalization the value of the confidence come the unit classified to the equipment behavior of the calculating.On the one hand, the calculating is set
It is standby to include:For by by the finite state machine included in the Complete Classification device model be converted into lifting decision tree come
The unit of the list of generation lifting decision tree;And for based on the lifting included in the list for lifting decision tree
Decision tree, to generate the unit of lean sorter model race, wherein being used for based on the normalization the value of the confidence come to the equipment
The unit that behavior is classified includes:For behavior vector information structure to be applied to the in the lean sorter model race
One lean sorter model is to generate the unit of analysis result;And it is used to determine whether to answer the behavior vector information structure
It is new to be generated based on the normalization the value of the confidence for the second lean sorter model in the lean sorter model race
Analysis result unit.
On the other hand, the computing device can include:For generating lean based on the Complete Classification device model
The unit of sorter model, and be wherein used for based on the normalization the value of the confidence the list classified to the equipment behavior
Member includes:For behavior vector information structure to be generated the unit of analysis result applied to the lean sorter model;With
And for using the analysis result and the normalization the value of the confidence come to determine the equipment behavior of the computing device be good
Property or non-benign unit.On the other hand, for generating the lean classification based on the Complete Classification device model
The unit of device model can include:For more by the way that the finite state machine included in the Complete Classification device model is converted into
It is a to lift decision tree to generate the unit of the list of lifting decision tree;For it is determined that it is evaluated with to the equipment behavior into
Multiple unique tests of the row classification without the excessive process resource of the consumption computing device, memory resource or energy resource
The unit of condition;For the list by sequentially traversing through the lifting decision tree, and by the lifting with each order traversal
The test condition that decision tree is associated is inserted into the list of the test condition, until the list of the test condition includes institute
Untill stating multiple unique test conditions, to generate the unit of the list of test condition;And for generating the lean grader
Model with only include a test condition of the test in multiple test conditions for including of list of the test condition that
The unit of a little lifting decision trees.On the other hand, for the behavior vector information structure to be applied to the lean grader
Whether model is that non-benign unit includes to determine the equipment behavior of the computing device:For will believe in behavior vector
The behavioural information being collected into that breath structure includes is applied to the multiple lifting decision-makings included in the lean sorter model
The unit of each lifting decision tree in tree;The behavioural information being collected into is applied in the lean point for calculating
The average weighted unit of the result of each lifting decision tree in the multiple lifting decision tree that class device model includes;
And for the unit by the weighted average compared with threshold value.
On the other hand, the computing device can include:For generating the S of renewal based on the normalization the value of the confidence
The unit of shape parameter;And for the S-shaped parameter of the renewal to be sent to the unit of the server computing device.Another
Aspect, the computing device can include:Unit for the S-shaped parameter that renewal is received from the server computing device;With
In determining the unit of new normalization the value of the confidence based on the S-shaped parameter of the renewal;And for based on the new normalizing
The unit for changing the value of the confidence to classify to the equipment behavior of the computing device.On the other hand, it is described for receiving
Complete Classification device model and the unit of the S-shaped parameter include being used for the unit for receiving finite state machine, the finite state machine
Including the information suitable for being expressed as two or more lifting decision trees, each lifting decision tree includes weighted value and test-strips
Part, the test condition is with identifying that the test condition will cause the computing device to can determine that the equipment behavior is benign
It is associated with the probable value of one of non-benign possibility.
Other side can include a kind of computing device, it includes:Processor, it is configured with processor-executable instruction
To perform operation, the operation includes:Complete Classification device model and S-shaped parameter are received from server computing device;Based on the S
Shape parameter come determine normalization the value of the confidence;And based on it is described normalization the value of the confidence come the equipment behavior to the computing device into
Row classification.On the one hand, the processor can be configured with processor-executable instruction to perform operation, and the operation is also wrapped
Include:By the way that the finite state machine included in the Complete Classification device model is converted into lifting decision tree, determine to generate lifting
The list of plan tree;And based on the lifting decision tree included in the list for lifting decision tree, to generate lean point
Lei Qi models race, and the processor can be configured with processor-executable instruction to perform operation so that based on described
Normalization the value of the confidence includes to carry out classification to the equipment behavior:Behavior vector information structure is classified applied to the lean
The first lean sorter model in device model race is to generate analysis result;And determine whether the behavior vector information knot
Structure is applied to the second lean sorter model in the lean sorter model race, with based on the normalization the value of the confidence next life
The analysis result of Cheng Xin.
On the other hand, the processor can be configured with processor-executable instruction to perform operation, the operation
Further include:Lean sorter model is generated based on the Complete Classification device model, and the processor can be configured with
Processor-executable instruction performs operation so as to the equipment behavior carries out classification bag based on the normalization the value of the confidence
Include:Behavior vector information structure is applied to the lean sorter model to generate analysis result;And use the analysis
As a result determine that the equipment behavior is benign or non-benign with the normalization the value of the confidence.
On the other hand, the processor can be configured with processor-executable instruction to perform operation so that be based on
The Complete Classification device model includes to generate the lean sorter model:By will be wrapped in the Complete Classification device model
The finite state machine included is converted into multiple lifting decision trees, to generate the list of lifting decision tree;It is it is determined that evaluated with right
The equipment behavior is classified without excessive process resource, memory resource or the energy resource for consuming the computing device
Multiple unique test conditions;By sequentially traverse through it is described lifting decision tree list, and by with each order traversal
The test condition that lifting decision tree is associated is inserted into the list of the test condition, until the list bag of the test condition
Untill including the multiple unique test condition, to generate the list of test condition;And the generation lean sorter model with
Only include those liftings of a test condition of the test in multiple test conditions that the list of the test condition includes
Decision tree.
On the other hand, the processor can be configured with processor-executable instruction to perform operation so that by institute
State behavior vector information structure and be applied to the lean sorter model, to determine whether the equipment behavior is non-benign bag
Include:The behavioural information being collected into included in the behavior vector information structure is applied in the lean sorter model
Each lifting decision tree in the multiple lifting decision trees included;Calculate and be applied to the behavioural information being collected into
The weighting of the result of each lifting decision tree in the multiple lifting decision tree that the lean sorter model includes
It is average;And by the weighted average compared with threshold value.On the other hand, the processor be configured with processor can
Execute instruction further includes to perform operation:The S-shaped parameter of renewal is generated based on the normalization the value of the confidence;And by described in more
New S-shaped parameter is sent to the server computing device.
On the other hand, the processor can be configured with processor-executable instruction and be further included to perform operation:From
The server computing device receives the S-shaped parameter of renewal;New normalization confidence is determined based on the S-shaped parameter of the renewal
Value;And based on the new normalization the value of the confidence, to classify to the equipment behavior.On the other hand, the processing
Device can be configured with processor-executable instruction to perform operation so that receive the Complete Classification device model and the S-shaped
Parameter includes receiving finite state machine, and the finite state machine includes being suitable for being expressed as two or more lifting decision trees
Information, each lifting decision tree includes weighted value and test condition, and the test condition is with identifying that the test condition will cause
The computing device can determine that the equipment behavior is that the probable value of one of benign and non-benign possibility is associated.
Further aspect can include a kind of non-transitory for being stored thereon with processor executable software instruction and calculate
Machine readable storage medium storing program for executing, the processor executable software instruction are configured such that the processor of computing device performs operation,
The operation can include:Complete Classification device model and S-shaped parameter are received from server computing device;Based on the S-shaped parameter
To determine normalization the value of the confidence;And classified based on the normalization the value of the confidence to equipment behavior.On the one hand, deposited
The processor-executable instruction of storage is configured such that processor performs operation and further includes:By will be in the Complete Classification
The finite state machine that device model includes is converted into lifting decision tree, to generate the list of lifting decision tree;And based on institute
The lifting decision tree that the list of lifting decision tree includes is stated, to generate lean sorter model race, wherein based on described
Normalization the value of the confidence includes to carry out classification to the equipment behavior:Behavior vector information structure is classified applied to the lean
The first lean sorter model in device model race is to generate analysis result;And determine whether the behavior vector information knot
Structure is applied to the second lean sorter model in the lean sorter model race, with based on the normalization the value of the confidence next life
The analysis result of Cheng Xin.
On the other hand, the processor-executable instruction stored is configured such that processor performs operation, the behaviour
Further include:Lean sorter model is generated based on the Complete Classification device model, and the processor stored can perform
Instruction be configured such that processor performs operation so that based on it is described normalize the value of the confidence come to the equipment behavior into
Row classification includes:Behavior vector information structure is applied to the lean sorter model to generate analysis result;And use
The analysis result and the normalization the value of the confidence determine that the equipment behavior is benign or non-benign.
On the other hand, the processor-executable instruction stored is configured such that processor performs operation, makes
The lean sorter model must be generated based on the Complete Classification device model to be included:By will be in the Complete Classification device mould
The finite state machine that type includes is converted into multiple lifting decision trees, to generate the list of lifting decision tree;It is determined that commented
Estimate to classify to the equipment behavior without excessive process resource, memory resource or the energy for consuming the computing device
Measure multiple unique test conditions of resource;By sequentially traversing through the list of the lifting decision tree, and will be with each order
The test condition that the lifting decision tree of traversal is associated is inserted into the list of the test condition, until the test condition
Untill list includes the multiple unique test condition, to generate the list of test condition;And the generation lean grader
Model with only include a test condition of the test in multiple test conditions for including of list of the test condition that
A little lifting decision trees.
On the other hand, the processor-executable instruction stored is configured such that processor performs operation, institute
Operation is stated to further include:The S-shaped parameter of renewal is generated based on the normalization the value of the confidence;And the S-shaped parameter by the renewal
It is sent to the server computing device.On the other hand, the processor-executable instruction stored is configured such that processing
Device performs operation, and the operation further includes:The S-shaped parameter of renewal is received from the server computing device;Based on the renewal
S-shaped parameter determine new normalization the value of the confidence;And based on the new normalization the value of the confidence, to the equipment behavior
Classify.
In addition aspect can include a kind of mobile computing device, it, which has, is configured with processor-executable instruction to hold
The processor of the operation of the row above method.
Other side includes being stored thereon with the non-transitory computer-readable storage medium of processor executable software instruction
Matter, the processor executable software instruction are configured such that the processor in mobile equipment performs the operation of the above method.
In addition aspect includes a kind of system, including:Mobile equipment including device handler;And it is configured with service
To perform the server of operation, the operation includes device executable instruction:Receive the language material of the information on mobile equipment behavior
Storehouse;Finite state machine is generated based on the corpus of information;And including suitable for be converted into it is multiple lifting decision trees data,
Each lifting decision tree includes test condition and weighted value;And it is sent to the finite state machine as Complete Classification device model
Mobile equipment.On the one hand, device handler can be configured with processor-executable instruction to perform operation, including receive
Full sorter model, lean sorter model is generated based on the Complete Classification device model received in a mobile device, and is made
The behavior for mobile equipment of being classified with lean sorter model is benign or non-benign.
On the one hand in system, device handler can be configured with processor-executable instruction to perform operation so that
The lean sorter model is generated based on the Complete Classification device model to be included to include in Complete Classification device model
Finite state machine is converted into the list of lifting decision tree, it is determined that the evaluated behavior with to mobile equipment classify without
Consume multiple unique test conditions of the excessive process resource for moving equipment, memory resource or energy resource;Pass through order
The list of ground traversal lifting decision tree, and the associated test condition of the lifting decision tree with each order traversal is inserted into
In the list of the test condition, untill the list of the test condition includes the multiple unique test condition, next life
Into the list of test condition;And the generation lean sorter model is with only including testing in the list of the test condition
Including multiple test conditions in a test condition the lifting decision tree that includes of list in the lifting decision tree.
On the one hand in system, device handler can be configured with processor-executable instruction to perform operation so that
Carrying out classification using behavior of the lean sorter model to mobile equipment includes:The behavioural information being collected into is applied to described
Each lifting decision tree in lean sorter model;Calculate and the behavioural information being collected into is applied in the lean
The weighted average of the result of each lifting decision tree in sorter model;And the weighted average and threshold value are carried out
Compare.On the one hand in system, device handler can be configured with processor-executable instruction to perform operation so that be based on
The Complete Classification device model includes to generate the lean sorter model:It will include in Complete Classification device model limited
State machine is converted into the list of lifting decision tree;And determined based on the lifting included in the list for lifting decision tree
Plan tree, to generate lean sorter model race, lean sorter model race includes lean sorter model and multiple extra
Lean sorter model, each lean disaggregated model in multiple extra lean disaggregated models include the uniqueness of varying number
Test condition.
On the one hand in system, device handler can be configured with processor-executable instruction to perform operation so that
The lean sorter model is generated based on the Complete Classification device model to be included:Multiple lean sorter models are generated, often
A lean sorter model includes the use of different weighted values and different threshold values to test the decision tree of first condition.One
In aspect system, device handler can be configured with processor-executable instruction to perform operation, and the operation further includes:Weight
Newly calculate associated with lifting decision tree threshold value in multiple lean sorter models and weighted value.
On the one hand in system, server can be configured with server executable instruction to perform operation so that multiple
Each test condition in test condition is with identifying that its associated test condition will make mobile equipment can determine computing device
Whether behavior is that the probable value of benign possibility is associated.On the one hand in system, server can be configured with server
To perform operation, the operation further includes executable instruction:Shifting is being sent to using finite state machine as Complete Classification device model
Before dynamic equipment, based on probable value come the tissue lifting decision tree in finite state machine.
Brief description of the drawings
The attached drawing for being incorporated herein and forming the part of this specification shows the illustrative aspect of claim, Yi Jiyu
General description given above and embodiment described below are used for the feature for explaining claim together.
Fig. 1 is the communication system for the network components for showing the exemplary telecommunication system suitable for being used together with various aspects
Block diagram.
Fig. 2 be show be configured to determine that specific mobile device behavior be malice, it is performance degradation, suspicious or good
The block diagram of example logic component and information flow in the mobile equipment of the one side of property.
Fig. 3 is the block diagram for showing to include exemplary components and information flow in the one side system of the webserver, the net
Network server is configured as combining mobile equipment to work together to determine that specific mobile equipment behavior is malice, performance drop
It is level, suspicious or benign.
Fig. 4 is the block diagram of the example components and information flow in the one side system for show to include mobile equipment, the shifting
Dynamic equipment is configured as generating target and lean (lean) sorter model according to Complete Classification device model, without re -training
Data, behavior vector or sorter model.
Fig. 5 A are the process streams for showing to generate the one side movement device, method of lean sorter model in a mobile device
Cheng Tu, the lean sorter model be included in the feature that the Complete Classification device model received from the webserver includes and
The subset of data point.
Fig. 5 B are the another aspect movement device, methods for showing local generation lean sorter model in a mobile device
Process flow diagram flow chart.
Fig. 5 C are one that the lean sorter model for being shown with locally generating is classified come the behavior to mobile equipment
Aspect moves the process flow diagram flow chart of device, method.
Fig. 5 D are the processes for showing to generate the another aspect movement device, method of lean sorter model in a mobile device
Flow chart.
Fig. 6 A are to show the one side webserver method that Complete Classification device model is generated in the webserver
Process flow diagram flow chart, the Complete Classification device model include being suitable for the classification for being used to generate more collection by mobile equipment and being neutralized lean
The lifting decision tree of device model.
Fig. 6 B are the processes for showing the illustrative methods for being suitable for generation lifting decision tree classifier according to various aspects
Flow chart.
Fig. 7 is the process streams for being included lifting the illustrative methods of the sorter model of decision tree according to the generation of one side
Cheng Tu.
Fig. 8 is can be generated by one side processor-server and generate lean grader by mobile device handler
The diagram of the exemplary lift decision tree of model.
Fig. 9 is the example being configured as in the observer module of execution dynamic and adaptive observation shown according to one aspect
The block diagram of property logical block and information flow.
Figure 10 be logical block in the computing system for realizing observer finger daemon shown according to another aspect and
The block diagram of information flow.
Figure 11 is the process flow diagram flow chart for showing the one side method for performing adaptive observation on the mobile apparatus.
Figure 12-16 is to show use S-shaped (sigmoid) parameter according to various aspects to calculate and be put using normalization
Letter value is for improved behavioural analysis and the process flow diagram flow chart of the method for classification.
Figure 17 applies to the blocks figure of the mobile equipment used in one aspect.
Figure 18 applies to the blocks figure of the server apparatus used in one aspect.
Embodiment
Various aspects will be described in detail with reference to the accompanying drawings.In the case of any possible, will be used throughout attached drawing identical
Reference numeral refers to the same or similar part.Reference to particular example and implementation is to be for the purpose of illustration, and
It is not intended to be limited to the scope of claim.
Represented " being used as example, example or explanation " using word " exemplary " herein.Here depicted as " exemplary "
Any implementation be not necessarily to be construed as it is preferably or more favourable than other implementations.
Generally speaking, various aspects include being used to effectively identify, classify, model, prevent and/or correct often with the time
Make the performance of mobile equipment and/or the webserver, the movement of the horizontal situation to degrade of utilization of power and/or mobile equipment behavior
Equipment, system and method.The webserver can be configured as to be received on various bars from central database (for example, " cloud ")
Part, feature, the information of behavior and corrective action, and use the information to generation Complete Classification device model (that is, data or behavior
Model), which depict can be with the form or knot by mobile equipment rapid translating into one or more lean sorter models
The large corpora of the behavioural information of structure.
On the one hand, Complete Classification device model can be the table of the large corpora of finite state machine description or behavioural information
Show.On the one hand, finite state machine can include being suitable for the information for being expressed as multiple lifting (boosted) decision trees.For example,
Finite state machine can be message structure, it can be represented as the family of lifting decision tree, its common identification, description, test
Or assessment with determine to move equipment behavior be it is benign or with the time facilitate the related feature of mobile equipment performance degradation and
Whole or many in data point.Then, the webserver can be sent to mobile equipment Complete Classification device model (that is, including
Message structure of family of finite state machine and/or lifting decision tree etc.).
Mobile equipment can be configured as reception and generated using Complete Classification device model different complexities it is horizontal (or
" lean degree ") lean sorter model or lean sorter model race.To achieve it, mobile equipment can reject bag
It is contained in from the sane race of the lifting decision tree in the Complete Classification device model that the webserver receives and (referred to herein as " carries completely
Rise decision tree classifier model "), include reducing the lifting decision tree of quantity with generation and/or assess the test-strips of limited quantity
The lean sorter model of part.This rejecting to lifting decision tree classifier model completely can have been come by described below
Into:Selection lifting decision tree;Identification is depending on the mobile device status identical with selected decision tree, feature, behavior or condition
All other lifting decision tree (and therefore can be applied based on definitive result);Include depending in lean sorter model
In selected by identical mobile device status, feature, behavior or condition and all other lifting decision trees identified;And pin
The selected lifting decision tree of limited quantity to being not yet contained in lean sorter model carrys out repetitive process.By this way,
Lean sorter model can be generated, it includes different mobile device status, feature, behavior or the condition depending on limited quantity
All lifting decision trees.Then mobile equipment can be come rapidly to movement using the lean sorter model that this is locally generated
Equipment behavior is classified, without consuming excessive its process resource, memory resource or energy resource.
In one aspect, mobile equipment can use different mobile device status, feature, behavior or the condition of varying number
To perform to the operation that lifting decision tree classifier model is repeatedly rejected completely, to generate the lean of different lean degree point
The family of class device model.For creating the different mobile device status of lean sorter model, feature, behavior or the quantity of condition
More, model will more be possible to accurately identify malice or suspicious actions, but disposal ability is more by what is be consumed.Therefore, one
Aspect, mobile equipment, which can be configured as, routinely applies the most lean person in lean sorter model race (namely based on minimum
The different mobile device status of amount, feature, the model of behavior or condition).If the knot generated by the sorter model of most lean
Fruit is suspicious, then the stronger of the more equipment states of assessment, feature, behavior or condition can be applied by moving device handler
(that is, less lean) sorter model, to determine that it is malice or benign that the behavior can be identified as.If by answering
The result generated with the sorter model of less lean is still suspicious, then can apply even stronger (or even less smart
Benefit) sorter model etc., until behavior be clearly categorized as it is malice or benign.
By being stored in central database (for example, " cloud ") on such behavior and the information of corrective action, and
The mobile equipment of configuration and the webserver carry out intelligence to use the information being stored in central database with reference to working together each other
Energy ground simultaneously efficiently identifies the factor for facilitating the performance of each mobile equipment and utilization of power level to degrade with the time, various aspects
Mobile equipment is enabled more accurately and effectively to identify and respond the performance limitation of mobile equipment and undesirable operation bar
Part.
In addition, include the sorter model of lifting decision tree by being generated in the webserver and these are classified
Device/model is sent to mobile equipment, and various aspects allow to move quantity of the equipment by rejecting lifting decision tree in the above described manner
Come quick in a mobile device and efficiently generate the sorter model of lean (or more concentrating), without accessing training data
Or further communicate with the webserver, central database or cloud network/server.This significantly reduces mobile equipment to net
The dependence of network, and further increase the performance and power consumption characteristics of mobile equipment.
Available in the future or expected many different honeycombs and mobile communication service and standard, it is all these to realize simultaneously
Be benefited in all its bearings.Such service and standard include such as third generation partner program (3GPP), Long Term Evolution (LTE)
System, third generation wireless mobile telecommunication technology (3G), forth generation wireless mobile telecommunication technology (4G), global system for mobile communications
GSM), Universal Mobile Telecommunications System (UMTS), 3GSM, General Packet Radio Service (GPRS), CDMA (CDMA) system (example
Such as cdmaOne, CDMA1020TM), for the enhancing data rate (EDGE) of GSM evolution, improved mobile telephone system
(AMPS), digital AMPS (IS-136/TDMA), Evolution-Data Optimized (EV-DO), Digital Enhanced Cordless telecommunications (DECT), the whole world
Microwave access mutual operability (WiMAX), WLAN (WLAN), Wi-Fi protection access I&II (WPA, WPA2) and integrated number
Word enhanced network (iden).Each technology in these technologies is directed to for example to voice, data, signaling and/or content
Message sends and receives.It should be appreciated that the term related with single telecommunication standard or technology and/or times of ins and outs
How the purpose being merely to illustrate is quoted, and is not intended to and the scope of claim is limited to specific communication system or technology,
Unless it is expressly recited in claim language.
Term " mobile computing device " and " mobile equipment " are used interchangeably herein, to refer to cell phone, intelligence
Phone, individual or mobile multimedia player, personal digital assistant (PDA), laptop computer, tablet PC, smartbook,
Super basis, palmtop computer, push mail receiver, the cell phone with multimedia internet function, wireless trip
Play controller and including memory with the performance for it be important programmable processor similar personal electronic equipments in
Any one or all, and it is favourable to be operable so that electricity saving method under battery capacity.Although various aspects for
The mobile computing device (such as smart phone) run with limited resources and on battery is particularly useful, but these aspects
It is typically useful in any electronic equipment including processor and execution application program.
In general, the performance and power efficiency of mobile equipment degrade with the time.Recently, anti-virus company (for example,
McAfee (McAfee), Symantec (Symantec) etc.) have begun to the movement that sales target is to slow down this degradation and prevent
Virus, fire wall and security product.However, many solutions in these solutions are depended on to the meter in mobile equipment
The periodicity for calculating intensive scanning engine performs, this may consume many processing of mobile equipment and battery resource, slow down or cause
Make mobile equipment useless within the extended period, and/or user experience is degraded in other ways.In addition, these solution party
Case is normally limited to detect known virus and Malware, and does not solve often combination to facilitate mobile equipment to degrade with the time
Multiple complicated factors and/or interaction (for example, when performance degradation be not as virus or Malware caused by).Due to these and
Other reasons, existing anti-virus, fire wall and security product do not provide enough solutions may facilitate movement to identify
Equipment with the degradation of time many factors, for preventing mobile equipment from degrading, or for aging movement equipment is effectively extensive
Its reset condition is arrived again.
There are various other solutions to be used for by using machine learning techniques or the mistake to performing on the computing device
The behavior of journey or application program is modeled to detect Malware.However, many solutions in these solutions are not
It is suitable for using on the mobile apparatus, because they need to assess very big data corpus, is limited to assessment and individually should
With program or process, or need to perform computation-intensive process in a mobile device.In this way, realize or hold in a mobile device
Solution as row may have significant negative and/or user to response, performance or the power consumption characteristics of mobile equipment
Appreciable influence.Due to these and other reason, existing modeling and machine learning solution are not well suited for using
Used in the complicated but resource-constrained system in modern mobile devices.
For example, the existing solution based on machine learning can include computing device being configured so that training data
Corpus export feature vector model as input.However, such solution will not be generated including limited shape
The Complete Classification device model (or sorter model race) of state machine (or other similar message structures), it is suitable for be converted into or table
It is shown as the multiple lifting decision trees for including test condition and weighted value.At least due to this reason, mobile device handler is not
Lean sorter model can be quickly and efficiently generated using such solution, which includes being used for
Quickly and efficiently identification, the lifting decision tree for the one group of concentration analyzed and/or classify mobile equipment behavior, and to mobile equipment
Response or performance or power consumption characteristics without significant, the passive or appreciable influence of user.
Mobile equipment is resource-constrained system, it is provided with relatively limited process resource, memory resource and energy
Source.Modern mobile devices are also complicated system, and for assess all various data flows, data manipulation (read, write-in,
Data encoding, data transfer etc.), process, component, behavior or factor (or combinations thereof) it is typically infeasible, these are probably
Malice or facilitate the performance degradation of mobile equipment in other ways.Due to these and other reason, for user, operating system
And/or be increasingly difficult to for application program (for example, anti-virus software etc.) source accurately and efficiently to identify problem and/or
The enough remedial measures for the problem of providing to identifying.As a result, mobile device user is at present for preventing the property of mobile equipment
The remedial measure that can degrade with utilization of power level with the time is seldom.
Various aspects include being used to effectively identify, classify, model, prevent and/or correct often making mobile equipment with the time
Performance and/or the webserver of the horizontal situation to degrade of utilization of power and/or mobile equipment behavior, mobile equipment, system
And method.
On the one hand, the observer process of mobile equipment, finger daemon, module or subsystem (collectively referred to herein as " module ")
Can be in each horizontal to various API, register, counter or other components (collectively referred to herein as " instrument of mobile device system
Change component ") carry out instrumentation or coordination.Observer module can be by collecting the behavioural information from instrumentation component come continuous
The mobile equipment behavior of (or close to continuously) monitoring.Mobile equipment can also include analyzer module, and observer module can
The behavioural information being collected into (for example, operated via memory write, function call etc.) to be sent to the analysis of mobile equipment
Device module.Analyzer module can receive and usage behavior information next life embarks on journey for vector, and Behavior-based control vector generates space
And/or temporal correlation, and use the information to determine specific mobile equipment behavior, subsystem, software application or process
It is benign, suspicious, malice or performance degradation.
Analyzer module, which can be configured as, performs real-time behavioural analysis operation, this can include believing the behavior being collected into
Breath is performed, carried out and/or using data, algorithm, grader or behavior model (collectively referred to herein as " sorter model "), to determine
Mobile equipment behavior is benign or non-benign (for example, malice or performance degradation).Each sorter model can be with
It is behavior model as described below:It includes to be used for assessing the certain party of mobile equipment behavior by mobile device handler
The information in face.Sorter model can be pre-installed in the upper and lower load of mobile equipment, be received from the webserver, in mobile equipment
Middle generation, or any combination thereof.Sorter model can be generated by using machine learning with other similar technologies.
Each sorter model can be classified as Complete Classification device model or lean sorter model.Complete Classification device
Model can be the robust data model to generate according to large-scale training dataset, it may include thousands of features and billions of
A entry.Lean sorter model can be the data model more concentrated from simplified data set generation, its only include with it is true
Fixed specific mobile equipment behavior is benign or non-benign (for example, malice or performance degradation) most related spy
Sign/entry.
As described above, it is understood that there may be thousands of a feature/factors and billions of a data points need to analyze correctly to know
The reason for not moving the degradation of equipment or source.Therefore, each sorter model used by analyzer module must be a large amount of
Feature, trained in factor and data point, be good to move equipment and can to make on specific mobile equipment behavior
Property or non-benign (for example, malice or performance degradation) accurate decision.But since mobile equipment is resource-constrained
System, so it is typically infeasible that all these features, factor and data point are assessed for analyzer module.Therefore,
Analyzer module application lean sorter model is very important, these models concentrate on assessment when to mobile equipment behavior into
The destination subset of all features, factor and data point analyzed in other ways will be needed during row classification.
Various aspects include being configured as being bonded to each other the mobile equipment and the webserver of work, with intelligence and efficiently
Identification and definite mobile equipment behavior are benign or non-benign maximally related feature, factor and data point (for example, malice or property
It can degrade).Include the sorter model of lifting decision tree by being generated in the webserver and by these grader/moulds
Type is sent to mobile equipment, and various aspects allow mobile equipment quickly and efficiently to generate lean grader mould in a mobile device
Type.
In in all fields, the webserver can be configured as from during cloud service/network or characterizing these rows
The bulk information on mobile equipment behavior and state, feature and condition is received between by a definite date.The information can be mobile equipment row
For the form of the very big cloud corpus of vector.The webserver can use the information to generation accurate description behavior vector
Very big cloud corpus Complete Classification device model (that is, robust data/behavior model).The webserver can generate
Full sorter model is with complete including any one movement equipment in multiple and different mobile equipment may be facilitated to degrade with the time
Portion or most of feature, data point and/or factor.
On the one hand, the webserver can generate Complete Classification device model to show or represent including limited state machine table,
Such as lifting decision tree or lifting decision tree race., can be limited by this by the application rejecting algorithm at mobile device handler
State machine shows or represents quickly and efficiently to reject, change or be converted to be suitable for what is used or perform in a mobile device
Lean sorter model.Finite state machine show or represent can be include test condition, status information, state transition rules and
The message structure of other similar informations.On the one hand, finite state machine performance or expression can be information knots as described below
Structure:It includes assessing or testing the large-scale race of the lifting decision tree of the condition of the behavior of mobile equipment, feature, factor or aspect
Or sane race.
Mobile equipment can be configured as from the webserver and receive Complete Classification device model, and complete using receiving
Full sorter model carrys out local generation lean sorter model (that is, data/behavior model) in a mobile device.Mobile equipment can
To reject the subset to lifting decision tree by one group of lifting decision tree in the Complete Classification device model for being included in receiving,
Subset identification, test, assessment and/or depending on the reduce quantity or different mobile device status of limited quantity, feature, OK
For or condition.This rejecting of the complete set to lifting decision tree can be completed by described below:Selection lifting decision tree;
All other lifting decision tree of the identification depending on the mobile device status identical with selected decision tree, feature, behavior or condition
(and therefore can be applied based on a definitive result);Include depending on identical mobile equipment in lean sorter model
State, feature, the selected and all other lifting decision trees identified of behavior or condition;And repeat the process for
The reduction quantity being not yet contained in lean sorter model/the selected lifting decision tree of limited quantity.By using difference
For mobile device status, feature, behavior or the tested condition of quantity to repeat the process, can generate has essence in various degree
The lean sorter model race of beneficial degree, the lean degree are determined by evaluated multiple states, feature, behavior or condition.Separately
Outside, each lean sorter model in these lean sorter models can by some in identical feature or condition or
Whole features or condition are tested or assessed as another lean sorter model, but use be assigned to test result,
The different threshold values and/or different weights of feature or the importance of evaluation condition.In this way, generation or regeneration lean grader mould
The process of type can include recalculating the threshold value and/or weight associated with decision tree.
Since these lean sorter models include the simplified subset of state, feature, behavior or the condition that must be tested
(compared with Complete Classification device model), observer and/or analyzer module can make to be used to quickly and accurately determine to move
Dynamic equipment behavior is benign or facilitates what mobile equipment performance degraded, without consuming the excessive processing money to mobile equipment
Source, memory resource or energy resource.As described above, in lean sorter model race most lean (namely based on minimum number
Test condition lean sorter model) can routinely be applied, until run into model cannot be classified as it is benign or dislike
The behavior (and therefore model be classified as suspicious) of meaning, can apply more sane (that is, less lean) essence at this time
Beneficial sorter model is benign or malice to attempt behavior being categorized as.The lean sorter model race in generation can be applied
The application of inside sane all the time lean sorter model, untill realizing to the clearly classification of behavior.By this way, observe
Device and/or analyzer module can be by that will be restricted to need to the use of most complete but resource-intensive lean sorter model
Situation of the sane sorter model definitely to classify to behavior, to ask for balancing between efficiency and accuracy.
In all fields, mobile equipment can be configured as by described below to generate one or more lean graders
Model:Finite state machine is represented/showed to be converted into lifting decision tree to generate one or more lean sorter models, will be complete
It is depending on the mobile equipment shape of the difference of limited quantity that the complete set for the lifting decision tree that full sorter model includes, which is rejected,
State, feature, behavior or the subset for lifting decision tree of condition or multiple subsets, and the subset or multiple using lifting decision tree
Subset is intelligently monitored, analyzes and/or classifies to mobile equipment behavior.Using lifting decision tree allow observer and/
Or analyzer module generates and applies lean data model, without, with re -training data, this is significantly dropped with cloud or network service
Low dependence of the mobile equipment to the webserver and cloud.This feedback eliminated between mobile equipment and the webserver is led to
Letter, this further improves the performance and power consumption characteristics of mobile equipment.
Lifting decision tree is with proper what a node (and therefore with a test problem or test condition) and power
One horizontal decision tree of weight values, and be therefore highly suitable for using in the binary classification to data/behavior.Also
It is to say, behavior vector is applied to lifting decision tree produces binary answer (for example, yes/no).If for example, by lifting decision-making
The problem of tree test/condition is that " Short Message Service (SMS) transmission frequency is less than x " per minute, then to lifting decision tree applicable value
" 3 " will cause "Yes" answer (for " and the SMS less than 3 " is transmitted) or "No" answer and (passed for the SMS of " 3 or more "
It is defeated).
It is effective to lift decision tree because they it is very simple and be it is original (and therefore need not be significant
Process resource).Lifted decision tree still very can parallelization, and therefore can it is parallel/simultaneously (for example, passing through movement
Multiple kernels or processor in equipment) apply or test many trees.
As described below, the webserver (or another computing device) can be from another more complicated mobile equipment behavior mould
Type (such as lifting decision-tree model) generation lifting decision making tree type Complete Classification device model.Such complex model can will be
The whole (or almost all) among equipment state, operation and the monitoring node of mobile equipment behavior is characterized in complicated categorizing system
Interaction set associative gets up.As described above, server or other computing devices can be by applying machine learning techniques next life
The model of the cloud corpus of the behavior vector for the mobile equipment collected into description from a large amount of mobile equipment, to generate complete complexity
Sorter model.For example, lifted decision tree classifier model can by can the decision node of test condition follow the trail of number
Hundred paths, are malice or benign determine to reach to current mobile device behavior.Many known study can be used
This complicated model is generated in the server with correlation modeling technology.Although this complicated model can be by from from number
The data of hundred mobile equipment are learnt effectively to accurately identify malicious act, but they set for specific movement
Standby configuration and the application of behavior may need largely to handle, particularly if if model is related to the multi-level decision-making tree of complexity.
Since mobile equipment is typically that resource is limited, equipment performance and battery life may be influenced using such model.
In order to which the Robust classification device model for being more advantageous to mobile equipment and using is presented, server is (for example, Cloud Server or net
Network server) or another computing device (for example, will be coupled into the mobile equipment or computer of mobile equipment) can will be complicated
Sorter model is converted into big lifting decision-tree model.Involved in decision tree it is simpler determine and in parallel processing
The ability of sorter model as middle application can enable mobile equipment preferably from point performed by the webserver
Be benefited in analysis.In addition, as discussed below, mobile equipment can be used hereafter using lifting decision tree Complete Classification device model
The each side method of description generates lean sorter model.
On the one hand, the server of generation lifting decision tree Complete Classification device model or other computing devices can be by abiding by
The each side process being described in more below is followed so to carry out.In short, server or other computing devices can select completely
Node (for example, lifting decision-tree model) in complex classifier model, and application model are gone to determine node to predict maliciously
For number percentage.In other words, server or other computing devices can select a branch of node, and follow
All subsequent nodes and the path of the branch are connected to, to determine that branch causes the small portion to the definite number of malicious act
Point.On the one hand, the sub-fraction of this number can be used for calculating " weight " factor for node.For example, with thereafter
Continuous path causes the decision node of a branch of 80% number of malicious act conclusion may be related to 0.8 weighted factor
Connection, it is the reliable indicator of potential malice (and being therefore suspicious) behavior to show the single decision node.Show as another
, the branch in complex classifier model may again result in the decision node of malicious act conclusion in terms of malicious act is identified
Almost without help, and it therefore may give low-down weighted factor or priority.
From each decision node follow the trail of result during, if decision node be not binary (that is, "Yes" or
"No"), then various test conditions can be applied to each node by server or other computing devices.For example, complex classifier
Model is adapted to a series of value (for example, quantity of the SMS message of transmission per minute), and wherein final conclusion depends on being somebody's turn to do
Value.However, the scope of value and the binary nature of pixel operation of decision tree are inconsistent.Therefore, server or other computing devices can be
A series of binary decisions of such Node Development or test, this contributes to the condition characterized by value.For example, server or other
Computing device can be generated and be tested multiple threshold tests or condition by complex classifier model, such as " more than one ", " more
In ten " and " being more than 100 ".Can by server based on its can according to the conclusion that draws of research complex model identifying or
Threshold test as selection.It is then possible to each such test based on thresholding is considered as single decision tree, it can be by
Test is with its definite predicted value and it is thus determined that it lifts factor.
Set by following in complex classifier model by the process of all decision nodes, server or other calculating
The standby single-layer model that complicated multilevel policy decision model can be transformed into a large amount of lifting decision trees.Then, server or other meters
Calculate equipment can by removing decision tree of its value less than threshold value come dressing mo del, so as to remove provide very small prediction or
The test condition for benefit of classifying is (for example, " be powered”).
Although the quantity of the such tree obtained in Complete Classification device model is larger, the binary nature of pixel operation of tree can promote
Into their application, particularly in resource-constrained processor.In one aspect, server or other computing devices can incite somebody to action
Lifting decision tree Complete Classification device model is supplied to mobile equipment for its use.
The process of the macrotaxonomy device model of generation lifting decision tree can be generated by Cloud Server, wherein the cloud service
Device analyzes the input from many mobile equipment and generates complete complex behavior sorter model, because such server will
With process resource and the processing time for completing analysis.However, as described above, each side method can also be by another meter
Equipment is calculated to perform, or even including mobile equipment.In terms of this, server (for example, cloud or webserver) can be by completely
Complex behavior sorter model be delivered to another computing device, which handles mould with can then proceed in above-outlined
Type, and lifting decision-tree model is converted into further detail below.Set for example, user is coupled to his/her movement
Standby personal computer can download complete complex behavior sorter model, and then execution each side method can to generate
For moving the large-scale lifting decision-tree model (for example, by wired or wireless data link) of equipment.As another example, move
Dynamic equipment can download complete complex behavior sorter model, and then perform each side method, such as when equipment just quilt
During period in late into the night when charging and being not used by, to generate the large-scale lifting decision-tree model that it is stored in memory.
Since the process by server or the realization of another computing device is closely similar, so each side method is retouched in more detail below
State to be performed by server.However, the description is for illustrative purposes, and it is not intended to and is limited to taking by each side method
Performed on business device, unless clearly so recording in the claims.
In further, mobile equipment can be configured as using lifting decision tree receive or self-generating
Macrotaxonomy device model come by select tested in decision tree limited quantity because usually building lean sorter model, and
Training data is not accessed and does not consume excessive process resource, memory resource or the energy resource of mobile equipment.Analyzer
Module can be identified Malware and equipment behavior is classified using the lean sorter model of selected lifting decision tree
For malice or benign.Described more fully below, mobile equipment can be classified by as described below to generate lean
Device model:Determine multiple (such as 15) features that monitoring will be tested, select fisrt feature and by the survey including this feature
All lifting decision trees of examination are incorporated to lean grader (for example, with the threshold value based on the value obtained from the feature monitored
All trees of test), and the process is repeated, until the quantity of the feature addressed in lean sorter model is identified
Untill quantity.It is worth noting that, the quantity of the lifting decision tree in this lean sorter model may substantially exceed
The quantity of feature.
On the one hand, mobile equipment can be configured as the Complete Classification device model for receiving and including finite state machine, this has
Limit state machine is suitable for being converted into multiple lifting decision trees.Mobile equipment can generate lean point based on Complete Classification device model
Class device model, it can be carried by the way that the finite state machine of Complete Classification device model is converted to lifting decision tree and using these
Decision tree is risen as lean sorter model to realize.
Various aspects can be realized in various communication systems, such as the example communication system 100 shown in Fig. 1.Allusion quotation
The cellular phone network 104 of type includes the multiple cellular basestations 106 for being coupled to network operation center 108, the network operation center
108 operations are with mobile equipment 102 (for example, cell phone, laptop computer, tablet PC etc.) and other network purposes
Between ground for example audio call sum number is connected via telephone land line (for example, POTS networks (not shown)) and internet 110
According to.Communication between mobile equipment 102 and telephone network 104 can be completed via two-way wireless communication link 112, such as
4G, 3G, CDMA, TDMA, LTE and/or other cellular telephone communication technologies.Telephone network 104 can also include one or more
Server 114, the server 114 are coupled to the network operation center 108 for the connection for being provided to internet 110 or in the nets
In network operation center 108.
Communication system 100 can also include being connected to telephone network 104 and the webserver 116 to internet 110.
Connection between the webserver 116 and telephone network 104 can be by internet 110 or by dedicated network (such as by dotted line
Arrow is shown).The webserver 116 is also implemented as the service in the network infrastructure of cloud service provider network 118
Device.Communication between the webserver 116 and mobile equipment 102 can pass through telephone network 104, internet 110, private network
Network (not shown) or any combination thereof realize.
Lean data/behavior model can be sent to mobile equipment 102 by the webserver 116, which can
To receive and be identified using lean data/behavior model suspicious or performance degradation mobile equipment behavior, software application, process
Deng.The webserver 116 can also send classification and modeling information replacing, updating, creating and/or tieing up to mobile equipment 102
Protect mobile device data/behavior model.
Mobile equipment 102 can collect behavior, state, classification, modeling, success rate and/or statistics in mobile equipment 102
Information, and the information being collected into is sent to the webserver 116 (for example, via telephone network 104) and is analyzed.Network
Server 116 can use the information received from mobile equipment 102 update refine lean data/behavior model or point
Class/modeling information with including further targetedly and/or reduction character subset.
On the one hand, mobile equipment 102 can be configured as using behavior, state, classification, the modeling, successfully being collected into
Rate and/or statistical information generate, update or refine lean sorter model (or data/behavior model), it includes movement and sets
In standby 102 further targetedly and/or reduction character subset.Which reduce in mobile equipment and the webserver
The amount of feedback communication between 116, and improve the performance and power consumption characteristics of mobile equipment 102.
Fig. 2 shows example logic component and the information flow moved on the one hand in equipment 102, the movement equipment 102
Be configured to determine that whether specific mobile equipment behavior, software application or process are malice/performance degradations, it is suspicious or
Benign.In the example shown in Fig. 2, mobile equipment 102 include measuring behavior device module 202, behavioural analysis device module 204,
External context information module 206, classifier modules 208 and actuator module 210.On the one hand, classifier modules 208 can be with
It is embodied as a part for behavioural analysis device module 204.On the one hand, behavioural analysis device module 204 can be configured as generation one
A or multiple classifier modules 208, each classifier modules in the classifier modules can include one or more classification
Device.
Each module in module 202-210 can with software, hardware or any combination thereof realize.In all fields,
Module 202-210 can be implemented in the part of operating system (for example, in kernel, in kernel spacing, in the user space
Deng), in separated program or application, in specialized hardware buffer or processor, or any combination thereof.On the one hand, mould
One or more of block 202-210 module can be implemented as what is performed in the one or more processors of mobile equipment 102
Software instruction.
Measuring behavior device module 202 can be configured as instrumentation or coordination at each level/module of mobile equipment
Application Programming Interface (API), and/monitored at module via instrumented API/in each level observe mobile device operation and
Event (for example, system event, state change etc.), collects the information of the operations/events on observing, is intelligently collected by filtration
The information arrived, the one or more observed results of information generation based on filtering, and the observed result of generation is stored in storage
In device (for example, medium in journal file) and/or by the observed result generated send (for example, via memory write, function
Call etc.) give behavioural analysis device module 204.
Measuring behavior device module 202 can be by collecting on the storehouse application programming in application framework or run-time library
Interface (API), system call API, file system and networking subsystem operations, equipment (including sensor device) state change with
And the information of other similar incidents, come monitor/observe mobile device operation and event.Measuring behavior device module 202 can also supervise
File system activity is surveyed, it can include search file name, the classification of file access (personal information or general data file), wound
Build or delete file (for example, the type such as exe, zip), file reading/access/search operation, change file permission etc..
Measuring behavior device module 202 can be with monitoring data network activity, it can include the type, agreement, end of connection
Server/customer end, the quantity of connection, the amount of communication or frequency that slogan, equipment are connected to etc..Measuring behavior device module 202
Telephone network activity can be monitored, it can include the monitoring calling that send, receive or intercept and capture or message (for example, SMS etc.)
Type and quantity (for example, the quantity (the number of premium calls placed) for the advanced call inserted).
Measuring behavior device module 202 can also monitor system resource use, it can include the number of the monitoring cross road (fork)
Amount, memory access operation, the quantity of documents etc. opened.Measuring behavior device module 202 can monitor the state of mobile equipment, its
It can include monitoring various factors, such as display is opening or closing, equipment is locked out or unlocks, remaining capacity, shines
State of camera etc..Measuring behavior device module 202 can also be for example by monitoring to key service (browser, contract provider
Deng) intention, the degree of interprocess communication, pop-up window etc. monitor interprocess communication (IPC).
Measuring behavior device module 202 can also monitor/observe the driver statistics and/or shape of one or more hardware componenies
State, hardware component can include camera, sensor, electronic console, WiFi communication component, recording controller, memory control
Device processed, system controller, access port, timer, ancillary equipment, wireless communication unit, external memory chip, voltage are adjusted
Device, oscillator, phaselocked loop, peripheral bridge and for supporting the processor that runs on a mobile computing device and client
Other likes.
Measuring behavior device module 202 can also monitor/observe expression mobile computing device and/or move equipment subsystem
One or more hardware counters of state or situation.Hardware counter can include the special register of processor/kernel, its
It is configured as being stored in counting or the state of the hardware correlated activation occurred in mobile computing device or event.
Measuring behavior device module 202 can also monitor/observe the action or operation of software application, from application download server
(such asApp Store servers) download software, the mobile facility information used by software application, call information,
Text message transmission information (for example, SendSMS, BlockSMS, ReadSMS etc.), media information transmission information (for example,
ReceiveMMS), user account information, positional information, camera information, accelerometer information, browser information, based on browsing
The content of the communication of device, the content of voice-based communication, short-distance wireless communication (for example, bluetooth, WiFi etc.), based on text
Communication content, the content of the audio file of record, telephone directory or associated person information, contacts list etc..
Measuring behavior device module 202 can monitor/observe the transmission or communication of mobile equipment, including with voice mail
(VoiceMailComm), device identifier (DeviceIDComm), user account information (UserAccountComm), calendar letter
Cease (CalendarComm), positional information (LocationComm), the audio-frequency information (RecordAudioComm) of record, acceleration
The communication of degree meter information (AccelerometerComm) etc..
Measuring behavior device module 202 can monitor/observe compass information, mobile equipment setting, battery life, gyroscope
Information, pressure sensor, magnet sensor, screen activity etc. use and renewal/change.Measuring behavior device module 202 can be with
Monitoring/observation sends software application and notice (AppNotifications) from software application to, using renewal etc..OK
It can monitor/observe for observer module 202 and is related with the first software application of the second software application of request download and/or installation
Condition or event.Measuring behavior device module 202 can monitor/observe the condition or event related with user's checking, such as defeated
Enter password etc..
Measuring behavior device module 202 can also monitor/observe the multiple horizontal situations or event in mobile equipment, including
Application level, radio level and sensor levels.Application level observation can include observing user via facial recognition software,
The social stream of observation, is observed by annotation input by user, observation is with using PassBook (Pay-in Book)/Google Wallet (Googles
Wallet) related/Paypal (shellfish precious) event etc..Application level observation can also be directed to use with virtual private networks including observation
(VPN) event and with synchronous, phonetic search, voice control (for example, locking locking/unlocking electricity by saying a word
Words), language translator, unloading for the data that calculate, video flowing, camera in the case of no User Activity use,
There is no the microphone in the case of User Activity the related event such as to use.
The horizontal appearance (presence) for observing any one or more that can include determining that in the following of radio,
In the presence of (existence) or quantity:User mutual before establishing Radio Communications Link or sending information with mobile equipment,
Double/multi-user's identity module (SIM) card, the Internet radio, mobile phone splice (tethering), and unloading is for calculating
Data, equipment state communication, as game console or home controller, vehicle communication, moves equipment synchronization etc..Wirelessly
Electric horizontal observation can also include monitoring to for positioning, reciprocity (p2p) communication, synchronization, the vehicles to vehicle communication
And/or the use of the radio-cell (WiFi, WiMax, bluetooth etc.) of machine to machine (m2m).The horizontal observation of radio can be with
Including the use of monitoring network flow, statistics or profile.
Sensor levels observation can include monitoring magnet sensor or other sensors to determine the use of mobile equipment
And/or external environment condition.For example, mobile device handler can be configured as definite phone whether in leather sheath (for example, via quilt
Be configured to sensing leather sheath in magnet magnet sensor) or in the pocket of user (for example, via by camera or light level
The light quantity that device detects).Detect mobile equipment in leather sheath may with identification suspicious actions it is related, for example, due to user
Actively use related activity and function (for example, shooting photo or video, send message, to carry out voice communication, recorded voice
Deng) it is probably to occur while mobile equipment is in leather sheath, this is probably the sign (example that malicious process is performed in equipment
Such as, track or spy upon user).
The other examples observed with the sensor levels used or external environment condition is related can include:Detect near-field communication
(NFC), information is collected from credit card scanner, barcode scanner or mobile tag reader, detects Universal Serial Bus
(USB) presence in power charge source, detects that keyboard or ancillary equipment are coupled to mobile equipment, has detected mobile equipment
Computing device (for example, via USB etc.) is coupled to, determines whether LED, flash of light, flash lamp or light source have been changed or disabled
(for example, malice disables urgent signaling application etc.), detects that loudspeaker or microphone have been opened or have powered, detect charging or
Power events, detect that mobile equipment is used as game console etc..Sensor levels observation can also include:From medical treatment or defend
Raw health care sensor collects information from scanning user's body, and information is collected from the external sensor of insertion USB/ audio jacks,
Information is collected from tactile or tactile sensor (for example, via vibrator interface etc.), collects Warm status on mobile equipment
Information etc..
In order to which the quantity of monitored factor is reduced to manageable level, on the one hand, measuring behavior device module 202
Rough observation can be performed by the initial behavior of monitoring/observation or sets of factors, the behavior or factor are possible to facilitate
The small subset for all factors that mobile equipment degrades.On the one hand, measuring behavior device module 202 can be from the webserver 116
And/or the component in cloud service or network 118 receives initial behavior and/or sets of factors.On the one hand, initial behavior/factor
Set can specify in the data/behavior model received from the webserver 116 or cloud service/network 118.In a side
Face, can specify initial row as/sets of factors in simplified characteristic model (RFM).
Behavioural analysis device module 204 and/or classifier modules 208 can receive observation knot with subordinate act observer module 202
Fruit, the information received (that is, observed result) is carried out with the contextual information received from external context information module 206
Compare, and recognition subsystem, process and/or the associated application of the observed result with receiving, these observed results are facilitated
(may either facilitate) equipment with the degradation of time or its may cause in other ways in equipment the problem of.
On the one hand, behavioural analysis device module 204 and/or classifier modules 208 can include being used to utilize limited information
Set (that is, rough observed result) come identify facilitate or may facilitate equipment with the time degrade or its may be in other ways
The intelligence of the behavior of the problem of causing in equipment, process or program.For example, behavioural analysis device module 204 can be configured as point
Analyse the information (example being collected into from various modules (for example, measuring behavior device module 202, external context information module 206 etc.)
Such as, in the form of observed result), learn the normal operating behavior of mobile equipment, and based on comparative result come generate one or
Multiple behavior vectors.The behavior vector of generation can be sent to classifier modules 208 and is used for into one by behavioural analysis device module 204
Step analysis.
Classifier modules 208 can be vectorial with reception behavior features, and by them compared with one or more behavioral modules,
To determine that specific mobile equipment behavior, software application or process are performance degradation/malice, benign or suspicious.
When it is malice or performance degradation that classifier modules 208, which determine behavior, software application or process, classifier modules
208 can notify actuator module 210, which can perform various actions or operation and be confirmed as disliking to correct
The mobile equipment behavior and/or execution operation of meaning or performance degradation identify healing, curing, isolating or repairing in other ways
The problem of.
When it is suspicious that classifier modules 208, which determine behavior, software application or process, classifier modules 208 can lead to
Knowing and doing is observer module 202, and behavior observer module 202 can adjust granularity (that is, the mobile equipment behavior quilt of its observation
The careful degree of observation) and/or based on the information received from classifier modules 208 (for example, the result of analysis operation in real time)
To change the behavior observed, generation or new or extra behavioural information is collected, and new/extra information is sent to
Behavioural analysis device module 204 and/or classifier modules 208 are used for further analysis/classification.In behavior observer module 202
This feedback communication between classifier modules 208 enables mobile equipment 102 recursively to increase the granularity of observation (i.e.,
Carry out finer or more detailed observation) or change the feature/behavior observed, until identifying suspicious or performance degradation
Mobile equipment behavior source untill, untill reaching processing or battery consumption threshold value, or at mobile equipment
Reason device determines that the source of suspicious or performance degradation mobile equipment behavior cannot be identified according to further increase observation granularity
Untill going out.Such feedback communication also enables mobile equipment 102 locally to adjust or change in a mobile device data/OK
For model, process resource, memory resource or energy resource without consuming excessive mobile equipment.
On the one hand, measuring behavior device module 202 and behavioural analysis device module 204 can be provided either individually or collectively pair
The real-time behavioural analysis of the behavior of computing system, to identify suspicious actions from limited and rough observed result, with dynamic
Ground determines behavior to observe in more detail, and dynamically determines the careful degree needed for observation.By this way, measuring behavior
Device module 202 enables mobile equipment 102 to efficiently identify and prevent that problem occurs on the mobile apparatus, without equipment
On a large amount of processors, memory or battery resource.
Fig. 3 and Fig. 4 shows example components and information flow in one side system 300, and the system 300 includes network
Server 116, it is configured as working together with reference to cloud service/network 118, with intelligence and efficiently identify positive malice or
The mobile equipment behavior in software application and/or suspicious or performance degradation mobile equipment 102 for writing bad, without consuming
Excessive process resource, memory resource or the energy resource of mobile equipment.In the example shown in Fig. 3, the webserver 116
Including cloud module 302,304 module of model generator and training data module 306.Mobile equipment 102 includes measuring behavior device mould
Block 202, classifier modules 208 and actuator module 210.On the one hand, classifier modules 208 can be contained in behavior analyzer
In module 204 (figure 2 illustrates) or as one part.On the one hand, 304 module of model generator can be real-time online
Grader.
Cloud module 302 can be configured as from cloud service/network 118 and receive bulk information, and generate complete or steady
Strong data/behavior model, it includes facilitating mobile equipment with the institute in the feature, data point and/or factor of the degradation of time
Have or most of.
304 module of model generator can be configured as based on the complete model generated in cloud module 302 to generate essence
Beneficial data/behavior model.On the one hand, the spy of the one or more reductions of generation can be included by generating lean data/behavior model
Model (RFM) is levied, it is included in the subset of the feature that the complete model generated by cloud module 302 includes and data point.One
Aspect, model generator 304 can generate the lean number for including initial characteristics set (for example, characteristic model of initial reduction)
According to/behavior model, the initial characteristics set includes being confirmed as having enabling classifier modules 208 finally definite specific
Mobile equipment behavior is the information of benign or malice/performance degradation maximum probability.Model generator 304 can be by generation
Lean model is sent to measuring behavior device module 202.
Measuring behavior device module 202 can monitor/observe mobile equipment behavior, generation observation based on the model received
As a result, and observed result is sent to classifier modules 208.Classifier modules 208 can perform real-time analysis operation, it can
Including data/behavior model is applied to the behavioural information being collected into by measuring behavior device module 202, equipment is moved with definite
Behavior is benign, suspicious or malice/performance degradation.When classifier modules 208 are classified without enough information
Or conclusively when definite behavior is benign or malice, classifier modules 208 can determine that mobile equipment behavior is suspicious
's.
When it is suspicious that classifier modules 208, which determine equipment behavior, classifier modules 208 can be configured as in fact
When analysis operation result send measuring behavior device module 202 to.Measuring behavior device module 202 can be based on from classifier modules
To adjust the granularity of its observation, (that is, observation movement is set 208 information received (for example, result based on real-time analysis operation)
The careful degree of standby behavior) and/or change the behavior observed, new or extra behavioural information is generated or collects, and will be newly
/ extra information is sent to classifier modules and is used for further analysis/classification (for example, in the form of new model).With this
Kind mode, mobile equipment 102 can recursively increase the granularity (that is, carrying out finer or more detailed observation) of observation or change
Become feature/behavior of observation, untill identifying the source of suspicious or performance degradation mobile equipment behavior, until reaching
Untill processing or battery consumption thresholding, or until mobile device handler determines suspicious or performance degradation mobile equipment behavior
Source cannot be identified according to further increase observation granularity untill.
The result and/or the success rate associated with the application of model that mobile equipment 102 can be operated are sent to net
Network server 116.The webserver 116 can (for example, via training data module 306) be based on be used for by model generator
304 result/success rates used generate training data.Model generator can generate the mould of renewal based on training data
Type, and the model of renewal is sent to mobile equipment 102.
In the example shown in Figure 4, feedback communication is not present between mobile equipment 102 and the webserver 116.It is more true
Say with cutting, mobile equipment 102 includes lean model generator module 402, it is configured as being based in complete model maker 404
Complete or more sane model middle generation and received from the webserver 116 generates concentration/targetedly behavior
Model.That is, the webserver 116 can be configured as is sent to mobile equipment 102 by Complete Classification device model, and
Mobile equipment 102 can be configured as based on Complete Classification device model to generate lean sorter model.Due in grader mould
Used in type (or comprising) lifting decision tree, therefore the excessive processing of mobile equipment or the feelings of battery resource can not consumed
This point is realized under condition.That is, the sorter model for the lifting decision tree being included in by generation in the webserver 116
And these grader/models are sent to mobile equipment 102, various aspects allow lean model generator module 402 to pass through
Reject be contained in Complete Classification device model lifting decision tree quantity without access training data or further with network
Server 116 or cloud network/server 118 communicate, and lean is quickly and efficiently generated in mobile equipment 102 (or more
Add concentration) sorter model.Dependence this significantly reduces mobile equipment to network service, and further improve shifting
The performance and power consumption characteristics of dynamic equipment 102.
Fig. 5 A show the grader/behavior model for generating lean or concentration in a mobile device (for example, being generated in model
Model generated in device module 402 etc.) one side method 500.Method 500 can be held by the process kernel in mobile equipment
OK.
In the block 502 of method 500, process kernel, which can receive, is or including finite state machine, lifting decision tree list
Or the Complete Classification device model of other similar information structures.On the one hand, Complete Classification device model includes finite state machine, this has
Limit state machine include be suitable for represent it is multiple lifting decision trees information and/or it include be suitable for by movement equipment be converted into it is more
The information of a lifting decision tree.On the one hand, finite state machine can be (or can include) in order or preferential lifting is determined
The list of plan tree.Each lifting decision tree in lifting decision tree can include test condition and weighted value.
As described above, lifting decision tree is (and therefore with a test problem or survey with just what a node
Strip part) and weighted value a horizontal decision tree, and be therefore highly suitable in the binary classification to data/behavior
Use.This means by feature vector or behavior vector be applied to lifting decision tree cause binary answer (for example, "Yes" or
"No").For example, if the problem of by lifting decision tree test/condition is that " frequency of SMS transmission is less than x " per minute, to carrying
Rise decision tree applicable value " 3 " will cause "Yes" answer (for " and less than 3 " SMS transmit) or "No" answer (for " 3 or more "
SMS transmission).
Fig. 5 A are returned to, in the block 504 of method 500, process kernel can determine the unique test-strips number of packages that should be evaluated
Amount, malice or benign is categorized as by mobile equipment behavior exactly, without consume mobile equipment excessive process resource,
Memory resource or energy resource.This can include determining that available process resource, memory resource and/or energy in mobile equipment
The amount of resource is measured, the amount of the process resource of the mobile equipment needed for test condition, memory resource or energy resource, passes through test
Condition come the associated priority and/or complexity of the behavior or condition that determine with to analyze or assess in a mobile device, with
And selection/determine the quantity of unique test condition, so that being provided in the available processes resource of movement equipment, memory resource or energy
The consumption in source, by the accuracy of the behavior realized according to test condition classification and the importance or preferential of the behavior by condition test
Ask for balancing or trade off between level.
In block 506, process kernel can travel through the list of lifting decision tree from starting, to utilize institute's quantification
Unique test condition fills the list of selected test condition.On the one hand, process kernel can also be selected test-strips
Each test condition in part determines absolute or relative priority value, and incites somebody to action absolute or relative priority value with it in selected survey
Corresponding test condition in examination condition list is stored in association.
In block 508, process kernel can generate lean sorter model, which is included in test institute
All lifting decision trees for selecting the Complete Classification device model of in test condition test condition to include.On the one hand, locate
Reason kernel can generate lean sorter model and lift decision-making with the order according to importance or priority value to include or represent
Tree.
In optional piece 510, the quantity of unique test condition can be increased, to be directed in block 506 by repeating traversal
The operation of the list of the lifting decision tree of large number of test condition generates another more sane (that is, less lean) essence
Beneficial sorter model, and another lean sorter model is generated in block 508.These operations can be repeated to generate lean point
Lei Qi models race.
Fig. 5 B show to generate the another aspect method 511 of data model in a mobile device.Method 511 can be set by movement
Process kernel in standby performs.In the block 512 of method 511, process kernel can receive dividing completely including finite state machine
Class device model.Finite state machine can be the message structure for including being suitable for being converted into the information of multiple lifting decision trees.In block
In 514, process kernel can be converted to the finite state machine included in Complete Classification device model including test condition and power
The lifting decision tree of weight values.
On the one hand, in block 512, process kernel can also be calculated or determined the lifting generated according to finite state machine and determine
The priority value of each lifting decision tree in plan tree.Process kernel can determine the priority of lifting decision tree, so that balance
Balance between accuracy that the mobile process resource of equipment, the consumption of memory resource or energy resource, behavior are classified etc..
Process kernel is also based on their associated weighted value, importance that is opposite or predicting test condition, to determine to carry
The priority of decision tree is risen, to classify etc. exactly to behavior.
Also in block 512, process kernel can generate first list (or other information structure), it includes, reference, identification
And/or tissue is according to its priority and/or the lifting decision tree generated with the order of its importance from finite state machine.For example,
First list can be generated as ordered list by process kernel, it includes the tree with limit priority as first item, so
It is with time tree of high priority value etc. afterwards.The significance sequence is also conceivable to the information collected from cloud corpus, and
Specific to the information for the equipment for being carrying out rejecting algorithm on it.
In block 516, the uniqueness that should be assessed when application lean sorter model can be calculated or determined in process kernel
The quantity (i.e., it is possible to mobile device status, feature, behavior or condition for being tested in decision tree is lifted) of test condition.Meter
Calculate or determine that the quantity of this unique test condition can be related to process resource in the mobile equipment needed for application model, storage
The consumption of device resource or energy resource and to realize lean sorter model behavior classification accuracy between ask for balance or
Compromise.It is such to determine can include determining that available process resource in mobile equipment, memory resource and/or energy resource
Amount, determines the priority and/or complexity associated with the behavior to be analyzed, and makes available resources and the priority of behavior
And/or complicated sexual balance.
In block 518, process kernel can by sequentially traverse through lifting decision tree first list and will with it is each
The test condition value insertion second list that the lifting decision tree of traversal is associated, to generate second list.Process kernel can be after
It is continuous to travel through first list and insert values into second list, until the length of second list is equal to definite unique test-strips
Untill the quantity of part, or untill second list includes unique test condition of all definite quantity.
In block 520, process kernel can generate lean classification based on the lifting decision tree included in first list
Device model.On the one hand, process kernel can generate lean sorter model only to include what test included in second list
The lifting decision tree (that is, the list of the test condition generated in block 518) of a test condition in test condition.
In optional piece 522, the quantity of unique test condition being increased, being directed to will pass through traversal in repeatable block 518
The operation of the list of the lifting decision tree of greater amount of test condition generates another more sane (that is, less lean) essence
Beneficial sorter model, and another lean sorter model is generated in block 520.These operations can be repeated to generate lean point
Lei Qi models race.
Fig. 5 C are shown using lean sorter model come the one side method 524 of the behavior for mobile equipment of classifying.Method
524 can be performed by the process kernel in mobile equipment.
In the block 526 of method 524, process kernel can perform observation with from each level of mobile device system
Carry out instrumented various parts and collect behavioural information.On the one hand, this can be via the measuring behavior discussed above with reference to Fig. 2
Device module 202 is completed.In block 528, process kernel can generate the behavioural information for characterizing observed result, being collected into
And/or the behavior vector of mobile equipment behavior.In addition in block 528, process kernel can be used and received from the webserver
Complete Classification device model generate the lean sorter model or lean grader of different complexities horizontal (or " lean degree ")
Model race.In order to accomplish this point, process kernel can reject the lifting decision tree race included in Complete Classification device model, with
Generation includes the lean sorter model for the test condition for reducing the lifting decision tree of quantity and/or assessing limited quantity.
In block 529, process kernel can select the lean sorter model race not yet by mobile equipment evaluation or application
In most lean grader (namely based on the model of minimal number of different mobile device status, feature, behavior or condition).
On the one hand, this can select the first sorter model to complete by process kernel in the ordered list of sorter model.
In block 530, the behavioural information being collected into or behavior vector can be applied to selected lean point by process kernel
Each lifting decision tree in class device model.Since lifting decision tree is binary decision, and same test is based on by selection
Many binary decisions of condition generate lean sorter model, so behavior vector is applied in lean sorter model
The process of lifting decision tree can perform in parallel work-flow.Alternatively, it can truncate or filter the behavior applied in block 530
Vector, should so as to further reduce to be only included in the test condition parameters for the limited quantity that lean sorter model includes
With the amount of calculation of the model.
In block 532, process kernel can be calculated or determined is applied to lean grader mould by the behavioural information being collected into
The weighted average of the result of each lifting decision tree in type.In block 534, weighted average that process kernel will can calculate
Value is compared with threshold value.In definite block 535, process kernel can determine the result of the comparison and/or by using institute
Whether the lean sorter model of selection is suspicious come the result generated.For example, process kernel can determine these the result is that
It is no to can be used for being categorized as behavior using high confidence level malice or benign, and it will then be considered as the behavior if not
Suspicious.
If process kernel definitive result is suspicious (for example, determining block 535="Yes"), process kernel can repeat
Operation in block 529-534 is to select and using stronger (that is, less lean) sorter model, it assesses more equipment
State, feature, behavior or condition, until behavior is categorized as using high confidence level it is malice or benign untill.If processing
Kernel definitive result is not suspicious (for example, determining block 535="No"), such as determines that behavior can by using high confidence level
With being classified as malice or benign, then in block 536, process kernel can use the comparative result generated in block 534
The behavior of mobile equipment is categorized as benign or potential malice.
In figure 5d in shown alternative aspect method 540, the operation described above with reference to block 518 and 520 can pass through
It is described below to realize:It is sequentially selected the lifting decision tree not yet in lean sorter model;Identification depend on it is selected
The identical mobile device status of the decision tree selected, feature, behavior or condition all other lifting decision tree (and therefore can be with
Applied based on a definitive result);Lean sorter model include depend on identical mobile device status, feature,
Behavior or the selected and all other lifting decision tree of condition;And repetitive process reaches the quantity equal to definite test condition
Number.Because all lifting decision trees depending on the test condition identical with selected lifting decision tree are added every time
Into lean sorter model, so limitation performs the test that the number of the process will be limited in lean sorter model and include
The quantity of condition.
As shown in Figure 5 D, in block 542, process kernel, which can be calculated or determined, to be assessed in lean sorter model
Unique test condition (that is, mobile device status, feature, behavior or the condition that can be tested in decision tree is lifted) quantity
(N).Unique test condition that this quantity is calculated or determined may relate to provide in the processing of the mobile equipment needed for application model
Source, memory resource or energy resource consumption and will be by between accuracy that the behavior that lean sorter model is realized is classified
Ask for balancing or trade off.It is such determine can include determining that available process resource in mobile equipment, memory resource and/or
The amount of energy resource, determines the priority and/or complexity associated with the behavior to be analyzed, and makes available resources and behavior
Priority and/or complicated sexual balance.
In block 544, the value of loop count variable can be equal to zero (0) by process kernel, or with other sides
Formula, which starts, to perform the loop of quantification n times.In block 546, process kernel can select the complete set in lifting decision tree
Lifting decision tree that is that conjunction includes or according to its generation and being not included in lean sorter model list.Pass through that for the first time
In loop will be in lean sorter model list without lifting decision tree, therefore will selection first lifting decision tree.Such as this
Mentioned by text, there is the first lifting decision tree that Complete Classification device model is configured such that in set completely identification to dislike
Meaning or the highest possibility of benign behavior.In block 548, process kernel can determine the test associated with selected decision tree
Condition.In block 550, process kernel can identify all decision-makings including in Complete Classification device model or according to its generation
Tree, it is depended on including or the test test condition identical with the test condition of selected decision tree.In block 552, processing
Kernel can by it is selected lifting decision tree and depend on including or test same test condition all liftings identified
Decision tree is added to lean sorter model list.
In block 554, process kernel can be incremented by the value of loop count variable.In definite block 556, process kernel can be with
Determine whether the value of loop count variable is greater than or equal to the quantity N of the unique test condition determined in block 542.When in processing
Core determine the value of loop count variable be no more than or equal to unique test condition quantity (that is, determining block 556="No") when,
Process kernel can be with the operation in repeatable block 546-554.When process kernel determines that the value of loop count variable is greater than or equal to solely
During quantity (that is, the determining block 556="Yes") of special test condition, in block 558, process kernel can generate lean grader mould
Type in lean sorter model list to include all lifting decision trees.
This method 540 can be used for multiple times to come by varying the quantity N of unique test condition in lean sorter model
To generate the lean sorter model race with different degrees of robustness or lean degree.For example, in optional piece 560, it is mobile
Device handler can increase the quantity N of the unique test condition determined in block 542, and more test conditions are incorporated to generate
Another lean sorter model.In optional definite block 562, whether processor can determine to accelerate N more than test
The maximum quantity (max N) of condition.Can based on assessment be difficult to needed for classification behavior maximum performance loss or resource investment come
(for example, by developer, service provider, user or via algorithm) determine the test condition of maximum quantity.If increased number
Amount N is less than maximum quantity max N (that is, determining block 562="No"), then can repeat the operation of above-mentioned block 544-560 with life
Into another lean sorter model.Once unique test condition of maximum quantity is included in lean sorter model
(that is, determining block 562="Yes"), then generating the process of lean sorter model can terminate.
Although Fig. 5 A, 5B and 5D are described by repeating to travel through the whole process gathered completely for lifting decision tree to generate
Lean sorter model race, but similar result can be realized by described below:Start from the lean grader mould of generation
Type (that is, the model generated in any piece in block 508,520 and 558), and for depending on not yet in the lean of generation
The test condition that sorter model includes be added to model lifting decision tree test condition addition quantity, carried to travel through
Rise the complete set of decision tree.
In addition, although Fig. 5 A, 5B and 5D describe generation from most lean to most sane lean sorter model race, also
It can be generated simply by described below from most steadily and surely to the lean sorter model of most lean:With the test of maximum quantity
Condition starts (for example, N=max N), and reduces quantity every time.
Fig. 6 A show the one side method 600 that Complete Classification device is generated in server or cloud.Method 600 can be by coupling
The process kernel in the server computing device of cloud network is closed to perform.
In block 602, process kernel can collect the corpus of behavioral data from many mobile equipment, including largely set
Standby state, configuration and behavior, and about whether the information for detecting malicious act.In block 604, process kernel can identify
Specific two-dimensional problem/the test-strips that can be tested in the equipment state in the corpus from behavioral data, configuration and behavior
Part., usually will a large amount of such two-dimensional problem/test conditions of identification in order to characterize all devices state, configuration and behavior.So
Afterwards, in block 606, for each two-dimensional problem identified, process kernel can be with test database with definite malicious act pair
The fraction or percentage of the number for the malicious act that should be answered in one or the other in the answer of two-dimensional problem.In block 608
In, process kernel can will have the power that be determined based on corresponding percentage of the corresponding two-dimensional problem selected as of highest with malicious act
First decision tree of weight values.In block 610, process kernel can lift the weight of sample/test condition of mistake classification, as follows
Literary reference chart 6B is described.
Then, the process kernel of server can be with the process of multiple scanning two-dimensional problem, it is assumed that the answer of first problem
It is the value (for example, "No") unconnected to malicious act, it is corresponding with highest with malicious act in this case to identify
The problem of.Then, this problem is arranged to second two-dimensional problem in model, and wherein its weighted value is based on its correspondence hundred
Ratio is divided to determine.Then, the process of server multiple scanning two-dimensional problem -- assuming that the answer of first problem/test condition
It is the value (for example, "No") unconnected to malicious act -- it is corresponding with highest with malicious act to identify in this case
Next problem/test condition.Then described problem/test condition is exactly the 3rd two-dimensional problem/test condition in model,
Wherein its weighted value is to correspond to percentage based on it come definite.Continued by all two-dimensional problem/test conditions identified
This process builds complete set.
During two-dimensional problem/test condition is generated, server can assess with scope (for example, communication frequency,
Or the quantity of the communication in preceding time interval) data, and formulate a series of two-dimensional problem/test conditions, it is with side
The mode of classification behavior is helped to include the scope.Therefore, a two-dimensional problem/test condition is probably that equipment is within first five minute
The no data transfer (it may have low correlation) that have sent more than zero, second two-dimensional problem/test condition is probably to set
It is standby whether to have have sent more than 10 data transfers (it have medium correlation) in first five minute, and the 3rd is asked
Topic/test condition be probably equipment whether have sent within first five minute more than 100 data transfers (its may have height
Correlation).
Some rejectings of a final basket/test condition can by Complete Classification device set be sent to mobile equipment it
It is preceding to be completed by server, such as to remove its definite weight or correlation to malicious act less than threshold value (for example, less than system
Count conspicuousness) those problem/test conditions.If for example, it is about 50/50 with the correlation of malicious act, then use
The decision tree may have seldom benefit, because it is malice or benign that these answers, which cannot all help to answer current behavior,
Problem.
Fig. 6 B are shown to be suitable for lifting the exemplary of decision tree/grader according to what various aspects used suitable for generation
Method for improving 620.Operation 622 in, processor can generate and/or perform decision tree/grader, from perform decision tree/point
Class device collects training sample, and generates new sorter model (h1 (x)) based on training sample.Training sample can include
The information being collected into from mobile equipment behavior, the previous observations of software application or process or the analysis in mobile equipment.Can be with base
In previous grader includes the problem of or the type of test condition and/or classification based on subordinate act analyzer module 204
The accuracy or performance characteristics that execution/application of past data/behavior model or grader in device module 208 is collected into, come
Generate training sample and/or new sorter model (h1 (x)).In operation 624, processor can lift (or increase) by generating
Decision tree/grader (h1 (x)) mistake classification entry weight, to generate second new tree/grader (h2 (x)).
On the one hand, can be based on the previous of grader be performed or is used the error rate of (h1 (x)) and generate training sample and/or newly
Sorter model (h2 (x)).On the one hand, can be based on being confirmed as having facilitating mistake in previous execution or using grader
Rate or the attribute classified to the mistake of data point by mistake, to generate training sample and/or new sorter model (h2 (x)).
In one aspect, the entry of mistake classification can be weighted based on its relative precision or validity.In operation 626
In, processor can lift the weight for the entry that (or increase) is classified by the second tree/grader (h2 (the x)) mistake generated, with
Generate the 3rd new tree/grader (h3 (x)).In operation 628, the operation of 624-626 can be repeated to generate the new of " t " quantity
Tree/grader (ht(x))。
By lifted or increased by the first decision tree/grader (h1 (x)) mistake classify entry weight, the second tree/
Grader (h2 (x)) more accurately can classify the entity classified by the first decision tree/grader (h1 (x)) mistake,
But some entities in the entity correctly classified by the first decision tree/grader (h1 (x)) may also be carried out with wrong classification.
Similarly, the three-tree/grader (h3 (x)) can be more accurately to being classified by the second decision tree/grader (h2 (x)) mistake
Entity is classified, and some entity mistakes point in the entity to correctly being classified by the second decision tree/grader (h2 (x))
Class.That is, spanning tree/grader h1 (x)-ht(x) race may not cause the system of global convergence, but cause can
With the multiple decision tree/graders performed parallel.
Fig. 7 shows the exemplary method 700 of generation sorter model, which includes lifting decision tree, and
It can be used for intelligent and efficient in the case where not consuming excessive process resource, memory resource or the energy resource of mobile equipment
It is suspicious or performance degradation in software application that is ground identification active malice or writing bad and/or mobile equipment 102
Mobile equipment behavior.In the operation 1 of method 700, the offline grader in the webserver can be based on from cloud service/network
The information received generates complete or sane sorter model.For example, Complete Classification device can include 40 (40) of test
100 lifting decision trees of a unique conditions.In the operation 2 of method 700, Complete Classification device model can be sent to movement
Analyzer/classifier modules 208 in equipment 102.In the operation 3 of method 700, analyzer/classifier modules 208 can be with base
Generated in analysis Complete Classification device model to lift one group of lean data/behavior model grader of form of decision tree.This can
To be realized by performing " combined feature selection function and rejecting " operation, which allows mobile equipment:Lean mould in generating run
Type is without accessing cloud training data;Each application dynamically reconfigures grader to strengthen classification accuracy;And
Specify the certainty complexity for each grader (for example, O (blaze))." combined feature selection function and rejecting " operation can be with
Including performing feature selecting operation.
Fig. 8 shows exemplary lift decision tree 800, it can be generated and by device handler by one side processor-server
To generate lean sorter model in a mobile device.In the example shown in Fig. 8, lifting decision tree 800 includes multiple determine
Plan node W1-W4, each decision node, which is included in when being performed or realized by processor, may cause decisive binary to answer (example
Such as, true or false, malice or benign etc.) the problem of or test condition (such as F1, F3, F5).Each decision node W1-W4 can be with
It is associated with weighted value.
Fig. 8 also shows the method 802 that " combined feature selection function and the rejecting " for performing and being discussed above with reference to Fig. 7 operates.Side
Method 802 can include the analyzer module of mobile equipment, it is used for the lean for determining its needs generation two unique conditions of test
Grader, in this case, feature selecting operation can include the list of 100 lifting decision trees of traversal, before discovery
Untill two unique conditions (for example, F1 and F3 in Fig. 8).Then analyzer/classifier modules 208 can be tested only by feature
The condition that selection operation (for example, F1 and F3) identifies, this can by travel through 100 lifting decision trees whole lists and
Any tree for deleting test different condition (for example, F5) is realized.It is remaining lifting decision tree (that is, test condition " F1 " and
The tree of " F3 ") lean grader is may be used as without re -training data.Analyzer/classifier modules 208 can believe behavior
Breath is applied to each lifting decision tree (that is, the tree of test condition " F1 " and " F3 ") in remaining lifting decision tree, calculates
The weighted average of all answers received from remaining tree, and determine that mobile equipment behavior is to dislike using weighted average
It is meaning or benign.
Once having generated lifting decision tree by feature selecting and rejecting process, selected decision tree can be used
Work can be with the grader or behavior model compared with current device state, setting and behavior.Since decision tree is independent
Binary is tested, therefore can perform row of the behavior (may be summarized to be behavior vector) that will be observed that compared with model parallel
For analytic process.Further, since tree is very simple (being substantially binary), therefore the processing that execution is each set is very simple,
Therefore can be rapidly completed with less processing expense.Each decision tree can provide the answer with weighted value, and
Can will be malice on behavior or benign final decision is determined as the resultful weighted sum of institute, this is also simply to count
Calculate.
Can be based on the information being collected into from previous observation or to mobile equipment behavior, software in a mobile device
Using or process analysis, to calculate the weight associated with node.It is also based on the data corpus (example of how many unit
Such as, the cloud corpus of data or behavior vector) structure lifting decision tree is used to, to calculate the power associated with each node
Weight.
Fig. 9 shows the measuring behavior for being configured as performing dynamic and the computing system of adaptive observation according to one aspect
Example logic component and information flow in device module 202.Measuring behavior device module 202 can include adaptive filter module
902nd, Throttle module 904, observer mode module 906, advanced behavioral value module 908, behavior vector generator 910 and safety
Buffer 912.Advanced behavioral value module 908 can include spatial coherence module 914 and temporal correlation module 916.
Observer mode module 906 can from each introduces a collection receive control information, its can include analyzer module (for example,
Above with reference to the behavioural analysis device module 204 of Fig. 2 descriptions) and/or using API.Observer mode module 906 can will be on each
The control information of kind observer pattern is sent to adaptive filter module 902 and advanced behavioral value module 908.
Adaptive filter module 902 can receive data/information from multiple sources, and intelligently filter the letter received
Cease the smaller information subset selected to generate from the information of reception.The filter can be based on receiving from analyzer module
Information or control are adapted to by the process of the higher level of API transmission.Filtered information can be sent to section
Flow module 904, it can be responsible for control from the information content of filter outflow, to ensure that advanced behavioral value module 908 will not become
It must spread unchecked or overload with request or information.
Advanced behavioral value module 908 can receive the data/information from Throttle module 904, from observer pattern
The control information of module 906, and the contextual information of other components from mobile equipment.Advanced behavioral value module 908
Room and time correlation can be performed using the information received, may cause equipment in sub-optimum level to detect or identify
The advanced behavior of upper execution.The result of room and time correlation can be sent to behavior vector generator 910, behavior vector
Maker 910 can receive relevant information and generation description particular procedure, the behavior vector of the application or behavior of subsystem.
On the one hand, behavior vector generator 910 can generate behavior vector so that particular procedure, application or subsystem it is each advanced
Behavior is the element of behavior vector.On the one hand, the behavior vector of generation can be stored in safety buffer 912.It is advanced
The example of behavioral value can include the presence of detection particular event, the amount or frequency of another event, between multiple events
Relation, the order that event occurs, time difference between the generation of some events etc..
In in all fields, measuring behavior device module 202 can perform progressive remodeling and control observation granularity.Also
It is to say, measuring behavior device module 202 can dynamically identify the corelation behaviour to be observed, and dynamically determine the row identified
For the careful degree that will be observed.By this way, measuring behavior device module 202 enable the system at various levels (for example,
Multiple rough and fine levels) monitor the behavior for moving equipment.Measuring behavior device module 202 can enable a system to adapt to just
In the content of observation.Measuring behavior device module 202 can be enabled a system to based on the concentration letter obtained from extensive true source
Subset is ceased to dynamically change the factor/behavior being observed.
As described above, measuring behavior device module 202 can perform adaptive observation technology, and based on being connect from each introduces a collection
Received information carrys out control observation granularity.For example, advanced behavioral value module 908 can be from Throttle module 904, observer pattern
906 receive information of module, and receive contextual information from other components (for example, sensor) of mobile equipment.As an example,
Performing the advanced behavioral value module 908 of temporal correlation can detect that camera has been used, and mobile equipment just attempts
Picture is uploaded onto the server.Advanced behavioral value module 908 can also carry out spatial coherence to determine in mobile equipment
Using whether in equipment have taken photo in leather sheath and when being attached to the waistband of user.Advanced behavioral value module 908 can be with
Determine whether advanced behavior that this detects (for example, in leather sheath while use during camera) is acceptable or common
Behavior, this can be by by the past behavior of current behavior and mobile equipment and/or the access information being collected into from multiple equipment
(for example, information that packet server of comforming receives) is compared realization.Take pictures and uploaded while due in leather sheath
To server be a kind of uncommon behavior (as can from leather sheath in the case of determined by the normal behaviour that observes
Like that), so in this case, advanced behavioral value module 908 may be identified as potential threat behavior and start
Appropriate response (for example, closing camera, sending alarm etc.).
On the one hand, measuring behavior device module 202 can be realized in some.
Figure 10 is illustrated in greater detail to patrol in more detail in the computing system 1000 for realizing one side observer finger daemon
Collect component and information flow.In the example shown in Figure 10, computing system 1000 includes the behavioral value device 1002 in user's space
Module, 1004 module of database engine and behavioural analysis device module 204, and circular buffer 1014 in kernel spacing, mistake
1016 modules of filter rule, regular 1018 modules of throttling and safety buffer 1020.Computing system 1000 can also include observation
Device finger daemon, it includes behavioral value device 1002 and database engine 1004 in user's space, and in kernel spacing
Safety buffer manager 1006, rule management 1008 and system health monitor 1010.
Various aspects can provide in the mobile equipment comprising webkit, SDK, NDK, kernel, driver and hardware
Cross-layer is observed, to characterize system action.Measuring behavior can carry out in real time.
Observer module can perform adaptive observation technology and control observation granularity.As described above, exist a large amount of
(that is, thousands of) may facilitate the factor of the degradation of mobile equipment, and monitoring/observation to facilitate the degradation of equipment performance
All difference factors are probably infeasible.In order to overcome this point, various aspects dynamically identify the corelation behaviour to be observed,
And dynamically determine the careful degree of the behavior identified to be observed.
Figure 11 shows the exemplary method 1100 for being used to perform dynamic and adaptive observation according to one aspect.In block 1102
In, mobile device handler can may facilitate the subset of a large amount of factor/behaviors of the degradation of mobile equipment by monitoring/observation
To perform rough observation.In block 1103, mobile device handler can be used to characterize rough sight based on rough observation to generate
Survey and/or the behavior of mobile equipment behavior is vectorial.In block 1104, mobile device handler can be identified with may potentially promote
Subsystem, process and/or the application associated into the rough observation of the degradation of mobile equipment.This can be for example by will be from multiple
The information that source receives is compared to realize with the contextual information received from the sensor of mobile equipment.In block 1106
In, mobile device handler can be based on observing come process performing analysis operation roughly.On the one hand, as block 1103 and 1104
A part, mobile device handler can be performed above with reference to one or more of Fig. 2-10 operations discussed operation.
In definite block 1108, mobile device handler can determine whether to identify with result that Behavior-based control is analyzed
With correction suspicious actions or potential problems.Determine to identify and school when the result of mobile device handler Behavior-based control analysis
When positive suspicious actions or potential problems (that is, determining block 1108="Yes"), in block 1118, processor can initiate to correct the row
For process and back to block 1102 to perform extra rough observation.
Determine that suspicious actions or potential problems cannot be identified when the result of mobile device handler Behavior-based control analysis
And/or during correction (that is, determining block 1108="No"), in definite block 1109, mobile device handler may determine whether to deposit
In the possibility of problem.On the one hand, mobile device handler can run into potential problems and/or ginseng by calculating mobile equipment
Whether more than predetermined threshold possibility of problems is determined with the probability of suspicious actions and the probability that determines to calculate.When
The probability that mobile device handler determines to calculate is not more than predetermined threshold and/or can not possibly exist and/or can detect can
When the behavior of doubting or potential problems (that is, determining block 1109="No"), processor may return to block 1102 to perform additionally thick
Slightly observe.
When mobile device handler determine there may be and/or detectable suspicious actions or potential problems (that is, determine block
1109="Yes") when, in block 1110, mobile device handler can perform deeper log recording/observation or final login
Subsystem, process or the application identified.In block 1112, mobile device handler can to identify subsystem, process
Or the deeper and more detailed observation of application execution.In block 1114, mobile device handler can be based on deeper and more detailed
Observe to perform further and/or deeper behavioural analysis.In definite block 1108, mobile device handler can base again
Determine whether suspicious actions or potential problems can be identified and correct in the result of deeper behavioural analysis.When mobile equipment
Processor determines suspicious actions or potential problems cannot be identified and correct (i.e., really based on the result of deeper behavioural analysis
Determine block 1108="No") when, processor can be asked with the operation in repeatable block 1110-1114 until careful degree is enough to identify
It is entitled only, either until determine problem cannot using extra details come the presence that identifies or have no problem untill.
When mobile device handler determines that suspicious actions or potential problems can be with based on the result of deeper behavioural analysis
During identified and correction (that is, determining block 1108="Yes"), in block 1118, mobile device handler can perform operation and come school
Direct problem/behavior, and processor may return to block 1102 to perform extra operation.
On the one hand, as method 1100 block 1102-1118 a part, mobile device handler can be performed to being
The real-time behavioural analysis of the behavior of system, to identify suspicious actions from limited and rough observation, is wanted with dynamically determining
The behavior observed in more detail, and dynamically determine the accurate careful degree needed for observation.This enables mobile device handler
Efficiently identify and prevent problem, without using substantial amounts of processor, memory or battery resource in equipment.
As described above, various aspects include method and are configured as realizing the computing device of the method, for using
Behavior-based control and machine learning techniques come efficiently identify, classify, model, prevent and/or correct would generally with the time and
Make condition and the behavior of horizontal performance, the power utilization of computing device, Web vector graphic level, security and/or privacy degradation.
To achieve it, computing device can perform real-time behavior monitoring and analysis operation, it can include monitoring and be set in calculating
The activity of one or more software applications of standby upper operation is (for example, by monitoring in hardware, driver, kernel, NDK, SDK
And/or the API Calls of Webkit levels etc.), the movable whole monitored of the one or more software applications of generation characterization or
The behavior vector information structure (" behavior vector ") of subset, is applied to Machine learning classifiers model by the behavior vector of generation
(" sorter model ") next life embarks on journey for vector information results of structural analysis, and using analysis result come by behavior vector (with
And the activity therefore characterized by the associated software application of the vector and/or the activity with being monitored) be categorized as it is benign or non-
Benign.
Also as discussed above, various aspects are included in the method that sorter model is generated in computing device, it can be wrapped
Include:Complete Classification device model is received from server computing device, the row of lifting decision tree are generated using Complete Classification device model
Table by the finite state machine included in Complete Classification device model (for example, by being converted into multiple lifting decision trees, wherein each
Lifting decision tree includes test condition and weighted value etc.), and based on the lifting decision tree that lifting decision tree list includes come
Generate lean sorter model (or lean sorter model race).Computing device can locally be generated using these and lean point
Class device model assesses the destination subset of the feature included in Complete Classification device model, for example, be confirmed as with to the specific meter
The behavior calculated in equipment carries out maximally related feature of classifying.In certain embodiments, computing device can by perform operation come
Using lean sorter model, the operation includes:The behavioural information that behavior vector information structure is included is applied in essence
The lifting decision tree that beneficial sorter model includes, calculates the behavioural information that will be collected into and is applied in lean sorter model
The weighted average of the result of each lifting decision tree, and weighted average and threshold value are compared to determine mobile equipment
Whether behavior is non-benign.In other words, behavior vector being applied to sorter model can generate with zero (0) and one
(1) analysis result of numerical value (P) form between.Configuring computing devices are depended on how, close to the value of zero (for example, 0.1)
It can indicate that by the behavior of behavior vector representation be benign, and the value close to 1 (such as 0.9) can be with indication action right and wrong
Benign (vice versa).
Most lean grader in lean sorter model race is (that is, including minimum decision node or assessment minimum number
Test condition lean sorter model) can routinely be applied, until run into model cannot be categorized as it is benign or non-
Untill benign behavior (or behavior vector), it can select and classify using more sane (that is, less lean) lean at this time
Device model, it is benign or malice to attempt behavior being categorized as.That is, in order to save resource, computing device processor can
Classified so that behavior vector to be applied to assess to the lean of the small subset (for example, 20 features) of all available feature/factors first
Device model (otherwise referred to as " characteristic model of reduction " or " RFM "), then using the sorter model gradually increased, until place
Reason device with high confidence level determine the behavior be it is benign or non-benign untill (for example, until obtained numerical value P is less than Xiamen
Limit value or higher than upper threshold).
For example, behavior vector can be applied to the grader of 20 features (i.e. RFM-20) of assessment by computing device first
Model.If analysis result is less than the first threshold value (for example, P<0.1), then computing device can utilize high confidence level by the row
It is benign without further analysis to be categorized as.Similarly, if analysis result higher than the second threshold value (for example,>0.9),
Then the behavior will can be categorized as non-benign without further analysis by computing device using high confidence level.In the opposing party
Face, and when analysis result falls between the first thresholding and the second thresholding (for example, P >=0.1 | | P<=0.9), computing device may
(enough) high confidence levels cannot be utilized to be categorized as behavior benign or non-benign.In this case, computing device can be with
Behavior vector is applied to larger sorter model (for example, RFM-40 or sorter model of 40 features of assessment) with generation
New analysis result, and repeat operation discussed above.Computing device can repeat these operations, until analysis result indicates
It is benign or non-benign (for example, until P using high confidence level behavior<0.1||P>0.9).
Although said system is typically effective, numerical value (P) not always real probable value.As a result, this number
Value (P) may not always represent that behavior is benign or non-benign possibility exactly.This is because to calculate P, system can
Can be firstly the need of using such asFormula calculate confidence value (c).Due to the uniqueness of benign and non-benign application
Behavior, one be likely to accumulate in using the confidence value (c) of the formula in very close 1 or very close 0 two extreme values
Around extreme value.As a result, there may be result of the high aggregation around two extreme values, (that is, the P values obtained can using above-mentioned formula
Energy very close 1 or very close is 0).
In view of these are true, computing device can be configured as using S-shaped parameter (α and β) to calculate normalization the value of the confidence
(c^), it is and benign or non-benign behavior to be categorized as using normalization the value of the confidence (c^), preferably to determine to be
It is no continue assessment behavior (such as, if more sane sorter model of selection etc.).
On the one hand, computing device may be configured to calculate normalization the value of the confidence (c^) using the following formula:
As shown in above formula, normalization the value of the confidence (c^) can pass through S-shaped parameter alpha and β and original the value of the confidence (c)
To define.Computing device can be configured as execution operation to realize above-mentioned formula, to calculate normalization the value of the confidence (c^).Meter
Calculate equipment and can use normalization the value of the confidence (c^) to determine the larger or sane sorter model of selection, or currently
It is benign or non-benign whether analysis result indicates that the behavior can be classified as using sufficiently high confidence level.
By using normalization the value of the confidence (c^), computing device can be reduced by the vectorial quantity of mistake classification, reduced
Report the quantity of (false positive) by mistake, reduce and fail to report the quantity of (false negative), and reduce that be classified as can
The number that doubtful and needs are further analyzed using more sane sorter model.As a result, computing device can be more accurately
Effectively classify to equipment behavior, preferably determine that behavior is benign or non-benign, and more effectively true
It is fixed whether to carry out extra analysis, such as select and use bigger or more sane sorter model, it will cause equipment behavior
More accurately classification.
In some respects, computing device, which can be configured as to combine, receives new sorter model from server computing device
To receive renewal or modification S-shaped parameter alpha and β.In some respects, computing device can be configured as based on historical information
(for example, collected from previous perform, the previous application of behavior model, it is previously determined go out normalization the value of the confidence etc.), new letter
Breath, machine learning, context modeling and the change detected in available information, mobile device status, environmental condition, net
Network situation, move equipment performance, battery consumption levels etc., on the computing device local update or modification S-shaped parameter alpha and βization.
In some respects, computing device can be configured as is sent to clothes by local update or the S-shaped parameter alpha and β of modification
Business device computing device, the server computing device can receive and using these parameters (for example, being set by using from many other
Standby other S-shaped parameters received carry out crowdsourcing to parameter) update sorter model and/or for the grader in server
Model generates new S-shaped parameter alpha and β.Such feedback communication allows system constantly to refine and adjust its model and operation, uses
Classify in improving (for example, more accurate, more efficient etc.) behavior.
Figure 12 shows the method 1200 classified according to one aspect using normalization the value of the confidence (c^) for improving behavior.
In block 1202, the processor of computing device can be received from server computing device Complete Classification device model and S-shaped parameter (such as
α and β).In embodiment, Complete Classification device model can include finite state machine, it includes being suitable for being expressed as multiple liftings
The information of decision tree.Each lifting decision tree can include test condition and weighted value, and each test condition can with it is general
Rate value is associated, and the probable value identifies that its associated test condition will make computing device can determine that the behavior is benign
And one of non-benign possibility.
In block 1204, processor can determine or calculate normalization the value of the confidence based on the S-shaped parameter received, such as
By using the following formula:
In block 1206, computing device can classify equipment behavior using normalization the value of the confidence.For example, one
Aspect, computing device can be by being converted into multiple carry by the finite state machine included in the Complete Classification device model received
Decision tree is risen to generate the list of lifting decision tree, is generated based on the lifting decision tree included in the list for lifting decision tree
Lean sorter model race, is applied to the first lean grader in sorter model race by behavior vector data/message structure
Model is to generate analysis result, and determines whether behavior vector data/message structure being applied in sorter model race
Second lean sorter model, to generate new analysis result based on normalization the value of the confidence, and in response to based on use compared with
The normalization the value of the confidence for the accuracy that increase behavior is classified is determined by strong sorter model, the analysis knot based on generation
Behavior is categorized as one of benign or non-benign by fruit.
Figure 13 is shown normalizes method of the value of the confidence (c^) for improving behavior classification according to the use of another aspect
1300.In block 1302, the processor of computing device can receive Complete Classification device model and S-shaped ginseng from server computing device
Number.In block 1304, processor can generate lean sorter model based on the Complete Classification device model received.In block
In 1306, processor can determine/calculate normalization the value of the confidence based on the S-shaped parameter received.In block 1308, processor
Behavior vector information structure can be applied to lean sorter model to generate analysis result.In block 1310, processor can
To determine that the behavior of computing device is benign or non-benign using analysis result and normalization the value of the confidence.
Figure 14 is shown normalizes method of the value of the confidence (c^) for improving behavior classification according to the use of another aspect
1400.In block 1402, the processor of computing device can receive Complete Classification device model and S-shaped ginseng from server computing device
Number.In block 1404, processor can be changed by the finite state machine that will include in the Complete Classification device model received
The list of lifting decision tree is generated into multiple lifting decision trees.In block 1406, processor can be based in lifting decision tree
The list lifting decision tree that includes generate lean sorter model race.In block 1408, processor can be based on receiving
To S-shaped parameter determine/calculate the one or more of one or more of lean sorter model lean sorter model
Normalize the value of the confidence.For example, on the one hand, processor can be calculated classifies for all leans in lean sorter model race
The single normalization the value of the confidence of device model.On the other hand, processor can be calculated for each in lean sorter model race
The normalization the value of the confidence of lean sorter model.
In block 1408, behavior vector information structure can be applied to the first lean in sorter model race by processor
Sorter model is to generate analysis result.In block 1410, processor may determine whether behavior vector information structure application
The second lean sorter model in sorter model race, with based on normalization the value of the confidence (for example, with the first lean grader
Normalization the value of the confidence that model or the second lean sorter model are associated) generate new analysis result.
Figure 15 is shown normalizes method of the value of the confidence (c^) for improving behavior classification according to the use of another aspect
1500.In block 1502, the processor of computing device can receive Complete Classification device model and S-shaped ginseng from server computing device
Number.In block 1504, processor can determine/calculate normalization the value of the confidence based on the S-shaped parameter received.In block 1506
In, behavior vector information structure can be applied to sorter model to generate new analysis result by processor.In block 1508,
Processor can update or change the S-shaped parameter received based on analysis result and/or definite normalization the value of the confidence.In block
In 1510, the S-shaped parameter of renewal can be sent to server computing device by processor.That is, in block 1510, calculate
Local update or the S-shaped parameter alpha and β of modification can be sent to server computing device by equipment, which can
To receive and using these parameters (for example, being carried out by using from other S-shaped parameters that many other equipment receive to parameter
Crowdsourcing), update sorter model for the sorter model in server and/or generate new S-shaped parameter alpha and β.This allows
System constantly refines and adjusts its model and operation is used to improve (for example, more accurate, more efficient etc.) behavior classification.
Figure 16 is shown normalizes method of the value of the confidence (c^) for improving behavior classification according to the use of another aspect
1600.In block 1602, the processor of computing device can receive Complete Classification device model and S-shaped ginseng from server computing device
Number.In block 1604, processor can determine/calculate normalization the value of the confidence based on the S-shaped parameter received.At optional piece
In 1606, behavior vector information structure can be applied to sorter model to generate new analysis result by processor.In block
In 1608, processor can receive the S-shaped parameter of renewal from server computing device.In block 1610, processor can be based on
The S-shaped parameter of the renewal received determines/calculates new normalization the value of the confidence.In block 1612, processor can be based on new
Behavior of the normalization the value of the confidence to computing device classify, such as by the way that behavior vector information structure is applied to grader
Model combines new normalization the value of the confidence to generate analysis result, using the analysis result being previously generated, by another behavior vector
Message structure is applied to identical or different sorter model to generate new analysis result etc..
Various aspects can be realized on a variety of computing devices, show that it shows in the form of smart phone in fig. 17
Example.Smart phone 1700 can include the processor for being coupled to internal storage 1704, display 1706 and loudspeaker 1708
1702.In addition, smart phone 1700 can include may be coupled to wireless data link be used for send and receive electromagnetic radiation
Antenna 1710, and/or be coupled to cell phone/transceiver 1712 of processor 1702.Smart phone 1700 is usually also
Including for receiving menu selection buttons or rocker switch XX20 input by user.
Typical smart phone 1700 further includes acoustic coding/decoding (CODEC) circuit 1716, it will be received from microphone
To sound figure turn to suitable for the packet that is wirelessly transferred, and by the voice data received packet decoded with
Generation is supplied to the analog signal of loudspeaker to generate sound.In addition, processor 1702, transceiver 1712 and CODEC
One or more of 1716 can include digital signal processor (DSP) circuit (not separately shown).
The a part of of each side method can realize in client-server architecture, wherein some processing in processing
Occur in the server, such as safeguard the database of normal operating behavior, it can be set when performing each side method by movement
Standby processor accesses.Such aspect can realize on any of various commercially available server apparatus, such as
Server 1800 shown in Figure 18.Such server 1800 generally includes the processor for being coupled to volatile memory 1802
1801 and the large capacity nonvolatile memory of such as disc driver 1803.Server 1800 can also include being coupled to processing
Floppy disk, compact disk (CD) or the DVD disc driver 1804 of device 1801.Server 1800 can also include being coupled to
The network access port 1806 of processor 1801, for establishing with network 1805 (for example, being coupled to other broadcast system computers
With the LAN of server) data connection.
Processor 1702,1801 can be configured any to compile with what is performed various functions by software instruction (application)
Journey microprocessor, microcomputer or processor chip or multi-chip, the function include various aspects described below
Function.In some movement equipment, multiple processors 1702 can be provided, such as are exclusively used in a processing of wireless communication function
Device and a processor for being exclusively used in operation other application.In general, software application can be accessed and loaded into processor
1702nd, in 1801 before can be stored in internal storage 1704,1802,1803.Processor 1702,1801 can include foot
To store the internal storage of application software instructions.
Various undesirable mobile device operations and characteristic, example are referred to using term " performance degradation " in this application
As longer processing time, slower real-time responsiveness, relatively low battery life, the loss of private data, the economy of malice are living
Dynamic (for example, sending unwarranted high price SMS message), refusal service (DoS), is carried out with requisition movement equipment or using phone
Espionage or the movable related operation of Botnet etc..
For performing the computer program code or " journey of the operation for execution various aspects on a programmed processor
Sequence code " can be write with high-level programming language, such as C, C++, C#, Smalltalk, Java, JavaScript, Visual
Basic, structured query language (for example, Transact-SQL), the various programming languages of Perl or other.Storage is in this application
The program code on computer-readable recording medium or program used can refer to the machine language that its form can be understood by processor
Say code (such as object code).
Many mobile computing device operating system nucleus are organized into user's space (wherein non-privileged code operation) and interior
Nuclear space (wherein authorization code operation).In Android (Android)It is this in other general public license (GPL) environment
Separation is especially important, is permitted wherein the code as a part for kernel spacing must be GPL, and in the user space
The code of operation may not be what GPL permitted.It should be appreciated that the various software part/modules discussed here can be empty in kernel
Between or user's space in realize, unless explicitly stated otherwise herein.
Preceding method describes and process flow diagram flow chart is only provided as illustrated examples, it is no intended to it is required that or implying each side
The step of face, must be performed by given order.As the skilled person will recognize, can perform in any order
The order of step in foregoing aspect." afterwards ", " then ", the word such as " next " be not intended to be limited to the order of step;
These words are used only to instruct reader throughout the description to method.In addition, for example using article " one (a) ", " one (an) " or
Any reference of the singulative of " being somebody's turn to do (the) " to claim elements is not necessarily to be construed as the key element being limited to odd number.
As used in this specification, term " component ", " module ", " system ", " engine ", " maker ", " management
Device " etc. is intended to include computer related entity, such as, but not limited to, is configured as performing the hardware of specific operation or function, consolidates
Part, the combination of hardware and software, software or executory software.For example, component can be but not limited to run on a processor
Process, processor, object, executable program, execution thread, program and/or computer.By way of explanation, operate in
Application and computing device on computing device can be said to component.One or more components may reside within process and/or
In the thread of execution, and component can be located on a processor or kernel and/or be distributed in two or more processors
Or between kernel.In addition, these components can be stored with the various non-transitory meters of various instructions and/or data structure from it
Calculation machine computer-readable recording medium performs.Component can pass through locally and/or remotely process, function or the invocation of procedure, electronic signal, data
Packet, memory read/write and other known network, computer, processor and/or the relevant communication means of process come
Communicate.
Can be by with reference to various illustrative components, blocks, module, circuit and the algorithm steps that each side disclosed herein describes
It is embodied as the combination of electronic hardware, computer software or both.In order to clearly demonstrate this interchangeability of hardware and software,
Various illustrative component, block, module, circuit and steps have been generally described according to its function above.As for so
Function be implemented as hardware or software, depending on application-specific and apply design constraint over the whole system.This area
Technical staff can be directed to each application-specific and realize described function in a manner of flexible, but such realize decision-making not
It should be interpreted to cause the scope for deviateing claim.
It is used for realization the various illustrative logicals with reference to each side disclosed herein description, logical block, module and circuit
Hardware, which can be utilized, to be realized or is performed with lower component:It is designed to perform general processor, the numeral of functions described herein
Signal processor (DSP), application specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic
Equipment, discrete gate or transistor logic, discrete hardware components.General processor can be multiprocessor, but
It is in the scheme of replacement, processor can be any traditional processor, controller, microcontroller or state machine.Processor
The combination of computing device is also implemented as, for example, the combination of DSP and multiprocessor, multiple multiprocessors are one or more more
The combination of processor and DSP core, or any other such configuration.Alternatively, can be by the electricity specific to given function
Road performs some steps or method.
In one or more illustrative aspects, described function can be come with hardware, software, firmware, or any combination thereof
Realize.If implemented in software, can be stored in using function as one or more processors executable instruction or code non-
On temporary computer-readable recording medium or non-transitory processor readable storage medium.Method disclosed herein or algorithm
Step can be embodied in may reside within that non-transitory is computer-readable or processor readable storage medium on processor can hold
In row software module.Non-transitory is computer-readable or processor readable storage medium can be can be by computer or processor
Any storage medium of access.By example and unrestricted, this non-transitory is computer-readable or processor readable medium can
To be set including RAM, ROM, EEPROM, flash memory, CD-ROM or other optical disc memory apparatus, disk storage equipment or other magnetic storages
It is standby, or can be used for by can by the instruction of computer access or data structure in the form of storage desired program code appoint
What other media.As used herein, disk and CD include compact disk (CD), laser shadow disk, CD, digital versatile disc
(DVD), floppy disk and Blu-ray Disc, wherein disk usually magnetically reproduce data, and CD then optically reproduces number with laser
According to.Combination of the above should also be as being included in non-transitory is computer-readable and processor readable medium within the scope of.In addition, side
The operation of method or algorithm, which can be used as code and/or one of instruction or any combination or gather, resides in non-transitory processor
On computer-readable recording medium and/or computer-readable medium, it can be incorporated into computer program product.
Being previously described so that any person skilled in the art can carry out or the right to use for disclosed aspect is provided
Profit requires.To the various modifications in terms of these, it will be apparent to those skilled in the art, and without departing substantially from
In the case of the scope of claim, generic principles defined herein can be applied to other side.Therefore, present disclosure is not
Aspects illustrated herein is restricted to, but is met consistent with appended claims and principle disclosed herein and novel feature
Widest scope.
Claims (30)
1. a kind of method for analyzing the behavior in computing device, including:
In the processor of computing device Complete Classification device model and S-shaped parameter are received from server computing device;
Normalization the value of the confidence is determined based on the S-shaped parameter;And
Classified based on the normalization the value of the confidence to the equipment behavior of the calculating.
2. according to the method described in claim 1, further include:
By the way that the finite state machine included in the Complete Classification device model is converted into lifting decision tree, determine to generate lifting
The list of plan tree;And
Based on the lifting decision tree that includes of list in the lifting decision tree, to generate lean sorter model race,
Wherein, included based on the normalization the value of the confidence to carry out classification to the equipment behavior:
Behavior vector information structure is applied to the first lean sorter model in the lean sorter model race to generate
Analysis result;And
The second lean for determining whether to be applied to the behavior vector information structure in the lean sorter model race is classified
Device model, to generate new analysis result based on the normalization the value of the confidence.
3. according to the method described in claim 1, further include:Lean grader mould is generated based on the Complete Classification device model
Type, wherein, included based on the normalization the value of the confidence to carry out classification to the equipment behavior of the computing device:
Behavior vector information structure is applied to the lean sorter model to generate analysis result;And
Using the analysis result and the normalization the value of the confidence come to determine the equipment behavior of the computing device be benign
Or it is non-benign.
4. according to the method described in claim 3, wherein, the lean grader is generated based on the Complete Classification device model
Model includes:
By the way that the finite state machine included in the Complete Classification device model is converted into multiple lifting decision trees, carried to generate
Rise the list of decision tree;
It is determined that the evaluated excessive processing to classify to the equipment behavior without consuming the computing device provides
Multiple unique test conditions in source, memory resource or energy resource;
By sequentially traversing through the list of the lifting decision tree, and the lifting decision tree with each order traversal is associated
Test condition be inserted into the list of the test condition, until the list of the test condition includes the multiple unique survey
Untill strip part, to generate the list of test condition;And
The lean sorter model is generated only to include multiple test-strips that test includes in the list of the test condition
Those lifting decision trees of a test condition in part.
5. according to the method described in claim 3, wherein, the behavior vector information structure is applied to the lean grader
Model, to determine whether the equipment behavior of the computing device is non-benign include:
The behavioural information being collected into included in the behavior vector information structure is applied in the lean grader mould
Each lifting decision tree in multiple lifting decision trees that type includes;
Calculate the behavioural information being collected into applied to the multiple lifting included in the lean sorter model
The weighted average of the result of each lifting decision tree in decision tree;And
By the weighted average compared with threshold value.
6. according to the method described in claim 1, further include:
The S-shaped parameter of renewal is generated based on the normalization the value of the confidence;And
The S-shaped parameter of the renewal is sent to the server computing device.
7. according to the method described in claim 1, further include:
The S-shaped parameter of renewal is received from the server computing device;
Based on the S-shaped parameter of the renewal received from the server computing device, to determine new normalization the value of the confidence;
And
Based on the new normalization the value of the confidence, to classify to the equipment behavior of the computing device.
8. according to the method described in claim 1, wherein, receiving the Complete Classification device model and the S-shaped parameter includes connecing
Finite state machine is received, the finite state machine includes being suitable for the information for being expressed as two or more lifting decision trees, each
Lifting decision tree includes weighted value and test condition, and the test condition is with identifying that the test condition will cause the calculating to set
The standby equipment behavior that can determine the computing device is that the probable value of one of benign and non-benign possibility is associated.
9. a kind of computing device, including:
For receiving Complete Classification device model and the unit of S-shaped parameter from server computing device;
For determining the unit of normalization the value of the confidence based on the S-shaped parameter;And
For based on the normalization the value of the confidence come the unit classified to the equipment behavior of the calculating.
10. computing device according to claim 9, further includes:
For being carried by the way that the finite state machine included in the Complete Classification device model is converted into lifting decision tree to generate
Rise the unit of the list of decision tree;And
For generating lean sorter model based on the lifting decision tree included in the list for lifting decision tree
The unit of race,
Wherein, for based on the normalization the value of the confidence come the unit classified to the equipment behavior of the computing device
Including:
For by behavior vector information structure be applied to the lean sorter model race in the first lean sorter model with
Generate the unit of analysis result;And
It is used to determine whether the second lean being applied to the behavior vector information structure in the lean sorter model race
Sorter model, to generate the unit of new analysis result based on the normalization the value of the confidence.
11. computing device according to claim 9, further includes:For generating essence based on the Complete Classification device model
The unit of beneficial sorter model, and wherein, for being classified based on the normalization the value of the confidence to the equipment behavior
Unit include:
For behavior vector information structure to be generated the unit of analysis result applied to the lean sorter model;And
For being to determine the equipment behavior of the computing device using the analysis result and the normalization the value of the confidence
Benign or non-benign unit.
12. computing device according to claim 11, wherein, it is described for being generated based on the Complete Classification device model
The unit of lean sorter model includes:
For by the way that the finite state machine included in the Complete Classification device model is converted into multiple lifting decision tree next life
Into the unit of the list of lifting decision tree;
For it is determined that being evaluated to classify to the equipment behavior without the excessive place for consuming the computing device
Manage the unit of multiple unique test conditions of resource, memory resource or energy resource;
For the list by sequentially traversing through the lifting decision tree, and by the lifting decision tree phase with each order traversal
Associated test condition is inserted into the list of the test condition, until the list of the test condition is including the multiple only
Untill special test condition, to generate the unit of the list of test condition;And
For the multiple surveys for generating the lean sorter model only to include including test in the list of the test condition
The unit of those lifting decision trees of a test condition in strip part.
13. computing device according to claim 11, wherein, it is described for the behavior vector information structure to be applied to
Whether lean sorter model is that non-benign unit includes with the definite equipment behavior:
The behavioural information being collected into for will include in the behavior vector information structure is applied to classify in the lean
The unit of each lifting decision tree in multiple lifting decision trees that device model includes;
It is for calculating that the behavioural information being collected into is the multiple applied to including in the lean sorter model
Lift the average weighted unit of the result of each lifting decision tree in decision tree;And
For the unit by the weighted average compared with threshold value.
14. computing device according to claim 9, further includes:
For generating the unit of the S-shaped parameter of renewal based on the normalization the value of the confidence;And
For the S-shaped parameter of the renewal to be sent to the unit of the server computing device.
15. computing device according to claim 9, further includes:
Unit for the S-shaped parameter that renewal is received from the server computing device;
For determining the unit of new normalization the value of the confidence based on the S-shaped parameter of the renewal;And
For based on the new normalization the value of the confidence, come the list classified to the equipment behavior of the computing device
Member.
16. computing device according to claim 9, wherein, for receiving the Complete Classification device model and S-shaped ginseng
Several units includes being used for the unit for receiving finite state machine, and the finite state machine includes being suitable for being expressed as two or more
The information of a lifting decision tree, it is each to lift decision tree and include weighted value and test condition, the test condition with identify described in
Test condition will cause the computing device can determine the equipment behavior of the computing device be it is benign and it is non-benign it
The probable value of one possibility is associated.
17. a kind of computing device, including:
Processor, it is configured with processor-executable instruction to perform the operation including the following:
Complete Classification device model and S-shaped parameter are received from server computing device;
Normalization the value of the confidence is determined based on the S-shaped parameter;And
Classified based on the normalization the value of the confidence to the equipment behavior of the computing device.
18. computing device according to claim 17, wherein, the processor is configured with processor-executable instruction
Perform the operation for further including the following:
By the way that the finite state machine included in the Complete Classification device model is converted into lifting decision tree, determine to generate lifting
The list of plan tree;And
Based on the lifting decision tree that includes of list in the lifting decision tree, to generate lean sorter model race,
And wherein, the processor is configured with processor-executable instruction to perform operation so that based on the normalization confidence
Value includes to carry out classification to the equipment behavior:
Behavior vector information structure is applied to the first lean sorter model in the lean sorter model race to generate
Analysis result;And
Determine whether the behavior vector information structure being applied to the lean sorter model race
In the second lean sorter model, to generate new analysis result based on the normalization the value of the confidence.
19. computing device according to claim 17, wherein:
The processor is configured with processor-executable instruction to perform operation, and the operation is further included to be divided completely based on described
Class device model generates lean sorter model, and
The processor is configured with processor-executable instruction to perform operation so that based on it is described normalization the value of the confidence come pair
The equipment behavior of the computing device, which carries out classification, to be included:
Behavior vector information structure is applied to the lean sorter model to generate analysis result;
And
Using the analysis result and the normalization the value of the confidence come to determine the equipment behavior of the computing device be benign
Or it is non-benign.
20. computing device according to claim 19, wherein, the processor is configured with processor-executable instruction
Perform operation so that the lean sorter model is generated based on the Complete Classification device model to be included:
By the way that the finite state machine included in the Complete Classification device model is converted into multiple lifting decision trees, carried to generate
Rise the list of decision tree;
It is determined that the evaluated excessive processing to classify to the equipment behavior without consuming the computing device provides
Multiple unique test conditions in source, memory resource or energy resource;
By sequentially traversing through the list of the lifting decision tree, and the lifting decision tree with each order traversal is associated
Test condition be inserted into the list of the test condition, until the list of the test condition includes the multiple unique survey
Untill strip part, to generate the list of test condition;And
The lean sorter model is generated only to include multiple test-strips that test includes in the list of the test condition
Those lifting decision trees of a test condition in part.
21. computing device according to claim 19, wherein, the processor is configured with processor-executable instruction
Perform operation so that the behavior vector information structure is applied to the lean sorter model to determine the computing device
The equipment behavior whether be non-benign include:
The behavioural information being collected into included in the behavior vector information structure is applied in the lean grader mould
Each lifting decision tree in multiple lifting decision trees that type includes;
Calculate the behavioural information being collected into applied to the multiple lifting included in the lean sorter model
The weighted average of the result of each lifting decision tree in decision tree;And
By the weighted average compared with threshold value.
22. computing device according to claim 17, wherein, the processor is configured with processor-executable instruction
Perform the operation for further including the following:
The S-shaped parameter of renewal is generated based on the normalization the value of the confidence;And
The S-shaped parameter of the renewal is sent to the server computing device.
23. computing device according to claim 17, wherein, the processor is configured with processor-executable instruction
Perform the operation for further including the following:
The S-shaped parameter of renewal is received from the server computing device;
New normalization the value of the confidence is determined based on the S-shaped parameter of the renewal;And
Based on the new normalization the value of the confidence, to classify to the equipment behavior of the computing device.
24. computing device according to claim 17, wherein, the processor is configured with processor-executable instruction
Perform operation so that receiving the Complete Classification device model and the S-shaped parameter includes receiving finite state machine, the limited shape
State machine includes being suitable for the information for being expressed as two or more lifting decision trees, and each lifting decision tree includes weighted value and survey
Strip part, the test condition is with identifying that the test condition will enable the processor to determine the institute of the computing device
Stating the probable value that equipment behavior is one of benign and non-benign possibility is associated.
25. a kind of non-transitory computer-readable storage media for being stored thereon with processor executable software instruction, the place
Reason device executable software instruction is configured such that the processor of computing device performs the operation for including the following:
Complete Classification device model and S-shaped parameter are received from server computing device;
Normalization the value of the confidence is determined based on the S-shaped parameter;And
Classified based on the normalization the value of the confidence to the equipment behavior of the computing device.
26. non-transitory computer-readable storage media according to claim 25, wherein, the processor stored can be held
Row instruction is configured such that the processor performs the operation for further including the following:
By the way that the finite state machine included in the Complete Classification device model is converted into lifting decision tree, determine to generate lifting
The list of plan tree;And
Based on the lifting decision tree that includes of list in the lifting decision tree, to generate lean sorter model race,
Wherein, included based on the normalization the value of the confidence to carry out classification to the equipment behavior of the computing device:
Behavior vector information structure is applied to the first lean sorter model in the lean sorter model race to generate
Analysis result;And
The second lean for determining whether to be applied to the behavior vector information structure in the lean sorter model race is classified
Device model, to generate new analysis result based on the normalization the value of the confidence.
27. non-transitory computer-readable storage media according to claim 25, wherein:
The processor-executable instruction stored is configured such that the processor performs operation, and the operation, which further includes, to be based on
The Complete Classification device model generates lean sorter model, and
The processor-executable instruction stored is configured such that the processor performs operation so that based on the normalization
The value of the confidence includes to carry out classification to the equipment behavior:
Behavior vector information structure is applied to the lean sorter model to generate analysis result;
And
Using the analysis result and the normalization the value of the confidence come to determine the equipment behavior of the computing device be benign
Or it is non-benign.
28. non-transitory computer-readable storage media according to claim 27, wherein, the processor stored can be held
Row instruction is configured such that the processor performs operation so that generates the lean based on the Complete Classification device model
Sorter model includes:
By the way that the finite state machine included in the Complete Classification device model is converted into multiple lifting decision trees, carried to generate
Rise the list of decision tree;
It is determined that the evaluated excessive processing to classify to the equipment behavior without consuming the computing device provides
Multiple unique test conditions in source, memory resource or energy resource;
By sequentially traversing through the list of the lifting decision tree, and the lifting decision tree with each order traversal is associated
Test condition be inserted into the list of the test condition, until the list of the test condition includes the multiple unique survey
Untill strip part, to generate the list of test condition;And
The lean sorter model is generated only to include multiple test-strips that test includes in the list of the test condition
Those lifting decision trees of a test condition in part.
29. non-transitory computer-readable storage media according to claim 25, wherein, the processor stored can be held
Row instruction is configured such that the processor performs the operation for further including the following:
The S-shaped parameter of renewal is generated based on the normalization the value of the confidence;And
The S-shaped parameter of the renewal is sent to the server computing device.
30. non-transitory computer-readable storage media according to claim 25, wherein, the processor stored can be held
Row instruction is configured such that the processor performs the operation for further including the following:
The S-shaped parameter of renewal is received from the server computing device;
New normalization the value of the confidence is determined based on the S-shaped parameter of the renewal;And
Based on the new normalization the value of the confidence, to classify to the equipment behavior of the computing device.
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US14/826,430 | 2015-08-14 | ||
US14/826,430 US10089582B2 (en) | 2013-01-02 | 2015-08-14 | Using normalized confidence values for classifying mobile device behaviors |
PCT/US2016/041470 WO2017030672A1 (en) | 2015-08-14 | 2016-07-08 | Using normalized confidence values for classifying mobile device behaviors |
Publications (1)
Publication Number | Publication Date |
---|---|
CN107924492A true CN107924492A (en) | 2018-04-17 |
Family
ID=56511920
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201680047561.4A Pending CN107924492A (en) | 2015-08-14 | 2016-07-08 | Classified using normalization the value of the confidence to mobile equipment behavior |
Country Status (5)
Country | Link |
---|---|
EP (1) | EP3335160A1 (en) |
JP (1) | JP2018533105A (en) |
CN (1) | CN107924492A (en) |
TW (1) | TW201710960A (en) |
WO (1) | WO2017030672A1 (en) |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN109582776A (en) * | 2018-12-04 | 2019-04-05 | 北京羽扇智信息科技有限公司 | Model generation method and device, electronic device and storage medium |
CN110298402A (en) * | 2019-07-01 | 2019-10-01 | 国网内蒙古东部电力有限公司 | A kind of small target deteection performance optimization method |
CN112131607A (en) * | 2020-09-25 | 2020-12-25 | 腾讯科技(深圳)有限公司 | Resource data processing method and device, computer equipment and storage medium |
Families Citing this family (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP3586285A4 (en) * | 2017-06-13 | 2020-01-01 | Beijing Didi Infinity Technology And Development Co., Ltd. | Systems and methods for recommending an estimated time of arrival |
TWI658372B (en) * | 2017-12-12 | 2019-05-01 | 財團法人資訊工業策進會 | Abnormal behavior detection model building apparatus and abnormal behavior detection model building method thereof |
JP6795529B2 (en) * | 2018-02-15 | 2020-12-02 | Kddi株式会社 | Communication analysis method and system |
CN108491720B (en) * | 2018-03-20 | 2023-07-14 | 腾讯科技(深圳)有限公司 | Application identification method, system and related equipment |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20130066815A1 (en) * | 2011-09-13 | 2013-03-14 | Research In Motion Limited | System and method for mobile context determination |
US20140237595A1 (en) * | 2013-02-15 | 2014-08-21 | Qualcomm Incorporated | APIs for Obtaining Device-Specific Behavior Classifier Models from the Cloud |
WO2015085265A1 (en) * | 2013-12-06 | 2015-06-11 | Qualcomm Incorporated | Methods and systems of using application-specific and application -type-specific models for the efficient classification of mobile device behaviors |
-
2016
- 2016-07-08 JP JP2018506387A patent/JP2018533105A/en active Pending
- 2016-07-08 WO PCT/US2016/041470 patent/WO2017030672A1/en active Application Filing
- 2016-07-08 CN CN201680047561.4A patent/CN107924492A/en active Pending
- 2016-07-08 EP EP16742116.3A patent/EP3335160A1/en not_active Withdrawn
- 2016-07-27 TW TW105123791A patent/TW201710960A/en unknown
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20130066815A1 (en) * | 2011-09-13 | 2013-03-14 | Research In Motion Limited | System and method for mobile context determination |
US20140237595A1 (en) * | 2013-02-15 | 2014-08-21 | Qualcomm Incorporated | APIs for Obtaining Device-Specific Behavior Classifier Models from the Cloud |
WO2015085265A1 (en) * | 2013-12-06 | 2015-06-11 | Qualcomm Incorporated | Methods and systems of using application-specific and application -type-specific models for the efficient classification of mobile device behaviors |
Non-Patent Citations (1)
Title |
---|
ALEXANDRU NICULESCU-MIZIL等: "Predicting Good Probabilities With Supervised Learning", 《PROCEEDINGS OF THE 22 ND INTERNATIONAL CONFERENCE ON MACHINE LEARNING》 * |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN109582776A (en) * | 2018-12-04 | 2019-04-05 | 北京羽扇智信息科技有限公司 | Model generation method and device, electronic device and storage medium |
CN109582776B (en) * | 2018-12-04 | 2021-07-09 | 北京羽扇智信息科技有限公司 | Model generation method and device, electronic device and storage medium |
CN110298402A (en) * | 2019-07-01 | 2019-10-01 | 国网内蒙古东部电力有限公司 | A kind of small target deteection performance optimization method |
CN112131607A (en) * | 2020-09-25 | 2020-12-25 | 腾讯科技(深圳)有限公司 | Resource data processing method and device, computer equipment and storage medium |
Also Published As
Publication number | Publication date |
---|---|
JP2018533105A (en) | 2018-11-08 |
WO2017030672A1 (en) | 2017-02-23 |
TW201710960A (en) | 2017-03-16 |
EP3335160A1 (en) | 2018-06-20 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN104885099B (en) | Algorithm is selected come the method and system efficiently classified to mobile equipment behavior using formula decision-making stub and combined feature selection function and picking is raised | |
CN105830080B (en) | Use the method and system efficiently classified that mobile device behavior is carried out specific to application and specific to the model of application type | |
CN106133642B (en) | The method and system of application state is inferred by process performing analysis operation in a mobile device | |
CN106716382B (en) | The method and system of aggregation multiple utility program behavioural analysis for mobile device behavior | |
CN104541293B (en) | Framework for client cloud behavior analyzer | |
CN107567628B (en) | The method and system of non-benign behavior is identified and responded for using the causality analysis for enhanced decision stub | |
US10089582B2 (en) | Using normalized confidence values for classifying mobile device behaviors | |
CN107077547B (en) | Use the method and system of the behavioural analysis for high-efficiency and continuous certification | |
CN107924492A (en) | Classified using normalization the value of the confidence to mobile equipment behavior | |
CN107580699A (en) | For the actuating specific to behavior with the method and system of real-time white list | |
CN104272788B (en) | Behavioural information is conveyed in mobile computing device | |
CN106104555B (en) | For protecting the behavioural analysis of peripheral equipment | |
US9324034B2 (en) | On-device real-time behavior analyzer | |
CN107209818A (en) | The method and system protected for improved Malware is interacted with the fictitious users of mobile device for detecting | |
CN107408178A (en) | The method and system of Malware are identified for the difference by cloud and client behavior | |
CN106796627A (en) | Method and system for moving the behavioural analysis of equipment behavior based on user role information | |
CN106663172A (en) | Methods and systems for detecting malware and attacks that target behavioral security mechanisms of a mobile device | |
CN107209825A (en) | The data flow tracking monitored via memory | |
CN106415580A (en) | Methods and systems for thwarting side channel attacks | |
CN107710687A (en) | The customized network business model abnormal for detecting application |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
WD01 | Invention patent application deemed withdrawn after publication | ||
WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20180417 |