Mobile device location anomaly detection based on non-location information
A location anomaly for a mobile device can be detected using non-location information from the mobile device. The non-location information does not include data from a location based device, such as a GPS. A probabilistic model is created using historical non-location information accumulated from the mobile device. Current non-location data is compared with the probabilistic model to determine a probability associated with the current non-location information. If the probability is less than a predetermined or configurable threshold, a location anomaly is detected. A notification of the location anomaly may be displayed and/or transmitted in response to detecting the location anomaly.
1. A method for detecting an anomalous location of a mobile device, the method comprising:
receiving, by one or more processors via a network interface, current non-location information from the mobile device at a current time, wherein the current non-location information does not include location information from the mobile device;
comparing, by the one or more processors, the current non-location information with a probabilistic model, wherein the probabilistic model is created using historical non-location information for the mobile device, wherein the historical non-location information does not include location information from the mobile device; and
generating, by the one or more processors, a location anomaly indication indicating that the mobile device is in a location that is anomalous at the current time in response to determining, based on the comparison, that the current non-location information is indicative of a location of the mobile device having a probability at the current time less than a threshold probability.
2. The method of claim 1 , wherein said generating the location anomaly indication includes generating the location anomaly indication in response to determining, based on the comparison, that the current non-location information is not predicted by the probabilistic model.
3. The method of claim 1 , wherein the current non-location information and the historical non-location information includes one or more elements selected from the group consisting of a serving cell identifier, a signal strength, an interface type, a neighboring cell identifier, a MAC address, an SSID, an RSSI, a sensor measurement from an auxiliary device of the mobile device, image data from a camera of the mobile device, an active application on the mobile device, and a derived status element.
4. The method of claim 1 , wherein the probabilistic model comprises a time grid.
5. The method of claim 1 , wherein the probabilistic model comprises a grid of activity of the mobile device.
6. The method of claim 1 , wherein the probabilistic model comprises a set of one or more possible locations of the mobile device and a probability for each possible location that the mobile device is in the possible location at the current time.
7. The method of claim 1 , wherein the probabilistic model is created from the historical non-location information for the mobile device by a machine-learning modeler.
8. The method of claim 1 , further comprising displaying a notification of the location anomaly indication on a display device.
9. The method of claim 1 , further comprising transmitting, by the one or more processors via the network interface, a notification of the location anomaly indication to a location anomaly notifier application executing on a monitor device.
10. A system for detecting an anomalous location of a mobile device, the system comprising:
a network interface configured to communicatively connect the system to a network;
at least one processor connected to the network interface by a bus; and
at least one non-transitory computer-readable storage medium connected to the network interface and the at least one processor by the bus,
wherein the at least one non-transitory computer-readable storage medium stores one or more processor-executable instructions that, when executed by the at least one processor, provide a location anomaly service configured to:
receive current non-location information from the mobile device at a current time, wherein the current non-location information does not include location information from the mobile device;
compare the current non-location information with a probabilistic model, wherein the probabilistic model is created using historical non-location information for the mobile device, wherein the historical non-location information does not include location information from the mobile device; and
generate a location anomaly indication indicating that the mobile device is in a location that is anomalous at the current time in response to determining, based on the comparison, that the current non-location information is indicative of a location of the mobile device having a probability at the current time less than a threshold probability.
11. The system of claim 10 , wherein the location anomaly service is configured to generate the location anomaly indication in response to determining, based on the comparison, that the current non-location information is not predicted by the probabilistic model.
12. The system of claim 10 , wherein the current non-location information and the historical non-location information includes one or more elements selected from the group consisting of a serving cell identifier, a signal strength, an interface type, a neighboring cell identifier, a MAC address, an SSID, an RSSI, a sensor measurement from an auxiliary device of the mobile device, image data from a camera of the mobile device, an active application on the mobile device, and a derived status element.
13. The system of claim 10 , wherein the probabilistic model comprises a time grid.
14. The system of claim 10 , wherein the probabilistic model comprises a grid of activity of the mobile device.
15. The system of claim 10 , wherein the probabilistic model comprises a set of one or more possible locations of the mobile device and a probability for each possible location that the mobile device is in the possible location at the current time.
16. The system of claim 10 , wherein the probabilistic model is created from the historical non-location information for the mobile device by a machine-learning modeler.
17. The system of claim 10 , wherein the location anomaly service is further configured to generate a display for displaying a notification of the location anomaly indication on a display device.
18. The system of claim 10 , wherein the location anomaly service is further configured to transmit, via the network interface, a notification of the location anomaly indication to a location anomaly notifier application executing on a monitor device.
19. A non-transitory computer readable storage medium comprising a set of instructions executable by a computer for detecting an anomalous location of a mobile device, the non-transitory computer readable storage medium comprising:
instructions for receiving, via a network interface, current non-location information from the mobile device at a current time, wherein the current non-location information does not include location information from the mobile device;
instructions for comparing the current non-location information with a probabilistic model, wherein the probabilistic model is created by a machine-learning modeler using historical non-location information for the mobile device, wherein the historical non-location information does not include location information from the mobile device;
instructions for generating a location anomaly indication indicating that the mobile device is in a location that is anomalous at the current time in response to determining, based on the comparison, that the current non-location information is indicative of a location of the mobile device having a probability at the current time less than a threshold probability;
instructions for generating a display for displaying a notification of the location anomaly indication on a display device; and
instructions for transmitting, via the network interface, the notification of the location anomaly indication to a location anomaly notifier application executing on a monitor device.
20. The non-transitory computer readable storage medium of claim 19 , wherein the current non-location information and the historical non-location information includes one or more elements selected from the group consisting of a serving cell identifier, a signal strength, an interface type, a neighboring cell identifier, a MAC address, an SSID, an RSSI, a sensor measurement from an auxiliary device of the mobile device, image data from a camera of the mobile device, an active application on the mobile device, and a derived status element.