IP Library › Granted Patent US 9,324,034
Granted Patent B2
US 9,324,034 · App. 13/773,247 · Granted Apr 26, 2016

On-device real-time behavior analyzer

Inventors: Rajarshi Gupta (Sunnyvale, CA); Xuetao Wei (Riverside, CA); Anil Gathala (Santa Clara, CA); Vinay Sridhara (Santa Clara, CA)
Assignee: QUALCOMM Incorporated
G06N99/005G06N5/043
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,324,034
App. No.
13/773,247
Granted
Apr 26, 2016
Kind
B2
Abstract

Methods, systems and devices for generating data models in a communication system may include applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors. Such behavior vectors may be used to compute a weight value for one or more nodes of the boosted decision tree. Classifier models factors having a high probably of determining whether a mobile device behavior is benign or not benign based on the computed weight values may be identified. Computing weight values for boosted decision tree nodes may include computing an exclusive answer ratio for generated boosted decision tree nodes. The identified factors may be applied to the corpus of behavior vectors to generate a second family of classifier models identifying fewer factors and data points relevant for enabling the mobile device to determine whether a behavior is benign or not benign.

Claims (128)

1. A method of generating data models in a communication system, comprising:

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an exclusive answer ratio for one or more nodes of the boosted decision tree; and

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed exclusive answer ratios.

2. The method of claim 1 , further comprising:

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

generating a mobile device classifier based on the second family of classifier models.

3. The method of claim 2 , further comprising:

sending the mobile device classifier to a mobile computing device.

4. The method of claim 3 , further comprising:

receiving the mobile device classifier in a device processor of the mobile computing device; and

classifying in the device processor a behavior of the mobile computing device based on the received mobile device classifier.

5. A communication system, comprising:

a server comprising:

means for applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

means for computing an exclusive answer ratio for one or more nodes of the boosted decision tree;

means for determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed exclusive answer ratios;

means for applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign;

means for generating a mobile device classifier based on the second family of classifier models; and

means for sending the generated mobile device classifier to the mobile device; and

a mobile computing device, comprising:

means for sending behavior vectors to the server;

means for receiving the mobile device classifier from the server; and

means for classifying a behavior of the mobile computing device based on the received mobile device classifier.

6. A communication system, comprising:

a server comprising a server processor configured with server-executable instructions to perform operations comprising:

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an exclusive answer ratio for one or more nodes of the boosted decision tree;

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed exclusive answer ratios;

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign;

generating a mobile device classifier based on the second family of classifier models; and

sending the generated mobile device classifier to the mobile device; and

a mobile computing device comprising a device processor configured with processor-executable instructions to perform operations comprising:

sending behavior vectors to the server;

receiving the mobile device classifier from the server; and

classifying a behavior of the mobile computing device based on the received mobile device classifier.

7. A server, comprising:

means for applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

means for computing an exclusive answer ratio for one or more nodes of the boosted decision tree; and

means for determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed exclusive answer ratios.

8. The server of claim 7 , wherein further comprising:

means for applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

means for generating a mobile device classifier based on the second family of classifier models.

9. The server of claim 8 , wherein further comprising:

means for sending the generated mobile device classifier to a mobile computing device.

10. A server, comprising:

a processor configured with processor-executable instructions to perform operations comprising:

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an exclusive answer ratio for one or more nodes of the boosted decision tree; and

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed exclusive answer ratios.

11. The server of claim 10 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

generating a mobile device classifier based on the second family of classifier models.

12. The server of claim 11 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:

sending the generated mobile device classifier to a mobile computing device.

13. A non-transitory computer readable storage medium having stored thereon server-executable software instructions configured to cause a server processor to perform operations for generating data models in a communication system, comprising:

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an exclusive answer ratio for one or more nodes of the boosted decision tree; and

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on the computed exclusive answer ratios.

14. The non-transitory computer readable storage medium of claim 13 , wherein the stored server-executable software instructions are configured to cause the server processor to perform operations further comprising:

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

generating a mobile device classifier based on the second family of classifier models.

15. The non-transitory computer readable storage medium of claim 14 , wherein the stored server-executable software instructions are configured to cause the server processor to perform operations further comprising:

sending the generated mobile device classifier to a mobile computing device.

16. A method of generating data models in a communication system, comprising:

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an answer ratio for one or more nodes of the boosted decision tree; and

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed answer ratios.

17. The method of claim 16 , further comprising:

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

generating a mobile device classifier based on the second family of classifier models.

18. The method of claim 17 , further comprising:

sending the mobile device classifier to a mobile computing device.

19. The method of claim 18 , further comprising:

receiving the mobile device classifier in a device processor of the mobile computing device; and

classifying in the device processor a behavior of the mobile computing device based on the received mobile device classifier.

20. A communication system, comprising:

a server comprising:

means for applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

means for computing an answer ratio for one or more nodes of the boosted decision tree;

means for determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed answer ratios;

means for applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign;

means for generating a mobile device classifier based on the second family of classifier models; and

means for sending the generated mobile device classifier to the mobile device; and

a mobile computing device, comprising:

means for sending behavior vectors to the server;

means for receiving the mobile device classifier from the server; and

means for classifying a behavior of the mobile computing device based on the received mobile device classifier.

21. A communication system, comprising:

a server comprising a server processor configured with server-executable instructions to perform operations comprising:

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an answer ratio for one or more nodes of the boosted decision tree;

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed answer ratios;

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign;

generating a mobile device classifier based on the second family of classifier models; and

sending the generated mobile device classifier to the mobile device; and

a mobile computing device comprising a device processor configured with processor-executable instructions to perform operations comprising:

sending behavior vectors to the server;

receiving the mobile device classifier from the server; and

classifying a behavior of the mobile computing device based on the received mobile device classifier.

22. A server, comprising:

means for applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

means for computing an answer ratio for one or more nodes of the boosted decision tree; and

means for determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed answer ratios.

23. The server of claim 22 , wherein further comprising:

means for applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

means for generating a mobile device classifier based on the second family of classifier models.

24. The server of claim 23 , wherein further comprising:

means for sending the generated mobile device classifier to a mobile computing device.

25. A server, comprising:

a processor configured with processor-executable instructions to perform operations comprising:

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an answer ratio for one or more nodes of the boosted decision tree; and

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed answer ratios.

26. The server of claim 25 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

generating a mobile device classifier based on the second family of classifier models.

27. The server of claim 26 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:

sending the generated mobile device classifier to a mobile computing device.

28. A non-transitory computer readable storage medium having stored thereon server-executable software instructions configured to cause a server processor to perform operations for generating data models in a communication system, comprising:

applying machine learning techniques to generate a first family of classifier models using a boosted decision tree to describe a corpus of behavior vectors;

computing an answer ratio for one or more nodes of the boosted decision tree; and

determining which factors in the first family of classifier models have a high probability of enabling a mobile device to conclusively determine whether a mobile device behavior is not benign based on computed answer ratios.

29. The non-transitory computer readable storage medium of claim 28 , wherein the stored server-executable software instructions are configured to cause the server processor to perform operations further comprising:

applying the factors to the corpus of behavior vectors to generate a second family of classifier models that identify fewer data points as being relevant for enabling the mobile device to conclusively determine whether the mobile device behavior is not benign; and

generating a mobile device classifier based on the second family of classifier models.

30. The non-transitory computer readable storage medium of claim 29 , wherein the stored server-executable software instructions are configured to cause the server processor to perform operations further comprising:

sending the generated mobile device classifier to a mobile computing device.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Mar 21, 2013
From: GUPTA, RAJARSHI; WEI, XUETAO; GATHALA, ANIL; SRIDHARA, VINAY
To: QUALCOMM INCORPORATED
Reel/Frame 030062/0515 →
Continuity (4)
Provisional Application 61748217 · Jan 2, 2013
Provisional Application 61646590 · May 14, 2012
Provisional Application 61683274 · Aug 15, 2012
Related Publication 20130304676A1 · Nov 14, 2013