Detecting fraud in connection with adverstisements
Embodiments are disclosed for identifying a suspect application based on multiple operating factors from use of multiple applications. The embodiments can generate a representative distribution of a selected factor based on collected information corresponding to multiple operating factors from use of multiple applications. The embodiments can compare a representative distribution of a target factor with the representative distribution of the selected factor and identify a suspect application when these distributions are different.
1. A method, performed by a computing device having a processor, comprising:
collecting first data related to a selected operating factor associated with use of two or more trusted applications on a first plurality of computing devices, the selected operating factor comprising a fingerprint pattern, a finger movement pattern, or a touch pattern;
generating a first representative distribution of the first data related to the selected operating factor;
receiving second data related to the selected operating factor associated with use of a target mobile device application on a second plurality of computing devices;
generating a second representative distribution of the second data related to the selected operating factor;
comparing the first representative distribution with the second representative distribution;
in an event that the first representative distribution does not meet a similarity criterion with the second representative distribution, identifying the target application as a suspect application; and
analyzing the suspect application to determine if the suspect application is malicious responsive to the first representative distribution not meeting the similarity criterion.
2. The method of claim 1 , wherein the multiple operating factors additionally include one or more of a remaining battery life, a brightness setting of a display, a remaining memory, a remaining calculation resource, a remaining disk space, an operating altitude, an operating location, an operating tilt value, an operating temperature, or an operating humidity.
3. The method of claim 1 , wherein the fingerprint pattern includes a size, a shape, or a relative position on a screen.
4. The method of claim 1 , wherein the representative distribution includes a normal distribution.
5. The method of claim 1 , wherein the representative distribution includes a bitmap.
6. The method of claim 1 , wherein the first set of information is collected from a trusted source.
7. The method of claim 1 , wherein analyzing the suspect application comprises detecting a correlation among the multiple operating factors.
8. A non-transitory computer-readable storage device storing instructions that when executed by a processor cause the processor to perform steps comprising:
collecting first data related to a selected operating factor associated with use of two or more trusted applications on a first plurality of computing devices, the selected operating factor comprising a fingerprint pattern, a finger movement pattern, or a touch pattern;
generating a first representative distribution of the first data related to the selected operating factor;
receiving second data related to the selected operating factor associated with use of a target mobile device application on a second plurality of computing devices;
generating a second representative distribution of the second data related to the selected operating factor;
comparing the first representative distribution with the second representative distribution;
in an event that the first representative distribution does not meet a similarity criterion with the second representative distribution, identifying the target application as a suspect application; and
analyzing the suspect application to determine if the suspect application is malicious responsive to the first representative distribution not meeting the similarity criterion.
9. The non-transitory computer-readable storage device of claim 8 , wherein the multiple operating factors additionally include one or more of a remaining battery life, a brightness setting of a display, a remaining memory, a remaining calculation resource, a remaining disk space, an operating altitude, an operating location, an operating tilt value, an operating temperature, or an operating humidity.
10. The non-transitory computer-readable storage device of claim 8 , wherein the fingerprint pattern includes a size, a shape, or a relative position on a screen.