Methods and systems for minimizing latency of behavioral analysis

1. A mobile device, comprising:

a transceiver configured to establish a network connection;

a cache memory; and

a processor coupled to the transceiver and the cache memory, and configured with processor-executable instructions to perform operations comprising:

populating the cache memory by:

observing a first group of mobile device behaviors over a period of time;

determining whether the cache memory stores a behavior vector that corresponds an observed mobile device behavior; and

identifying a limited set of behaviors that are associated with operations that are inconsistent with normal operation patterns of the mobile device, receiving inputs regarding the limited set of behaviors, performing temporal and spatial correlations of the inputs, generating a first behavior vector based on a result of the spatial and temporal correlations, and storing the first behavior vector in the cache memory in response to determining that the cache memory does not store any behavior vectors that correspond to the observed mobile device behavior; and

performing behavior-based analysis operations comprising:

observing a second group of mobile device behaviors;

generating a second behavior vector based on the second group of mobile device behaviors;

determining whether the second behavior vector matches one of the behavior vectors stored in the cache memory;

taking a corrective action in response to determining that the second behavior vector matches one of the behavior vectors stored in the cache memory;

using the second behavior vector to determine whether one or more behaviors in the second group of mobile device behaviors are benign in response to determining that the second behavior vector does not match any of the behavior vectors stored in the cache memory; and

storing the second behavior vector in the cache memory in response to determining that one or more behaviors in the second group of mobile device behaviors are not benign.

2. The mobile device of claim 1 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving a third behavior vector from a second mobile device; and

storing the third behavior vector in the cache memory.

3. The mobile device of claim 1 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving a third behavior vector from a network server; and

storing the third behavior vector in the cache memory.

4. The mobile device of claim 1 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:

transmitting a message to a server via the network connection to determine whether the second behavior vector matches a vector stored in a server memory of a service in response to determining that the second behavior vector does not match one of the behavior vectors stored in the cache memory; and

taking the corrective action in response to determining that the second behavior vector matches one of the behavior vectors stored in the server memory.

5. A mobile device, comprising:

means for populating a cache memory of the mobile device, comprising:

means for observing a first group of mobile device behaviors over a period of time;

means for determining whether the cache memory stores a behavior vector that corresponds an observed mobile device behavior; and

means for identifying a limited set of behaviors that are associated with operations that are inconsistent with normal operation patterns of the mobile device, receiving inputs regarding the limited set of behaviors, performing temporal and spatial correlations of the inputs, generating a first behavior vector based on a result of the spatial and temporal correlations, and storing the first behavior vector in the cache memory in response to the determining that the cache memory does not store any behavior vectors that correspond to the observed mobile device behavior; and

means for performing behavior-based analysis operations, comprising:

means for observing a second group of mobile device behaviors;

means for generating a second behavior vector based on the second group of mobile device behaviors;

means for determining whether the second behavior vector matches one of the behavior vectors stored in the cache memory; and

means for taking a corrective action in response to determining that the second behavior vector matches one of the behavior vectors stored in the cache memory;

means for using the second behavior vector to determine whether one or more behaviors in the second group of mobile device behaviors are benign in response to determining that the second behavior vector does not match any of the behavior vectors stored in the cache memory; and

means for storing the second behavior vector in the cache memory in response to determining that one or more behaviors in the second group of mobile device behaviors are not benign.

6. The mobile device of claim 5 , further comprising:

means for receiving a third behavior vector from a second mobile device; and

means for storing the third behavior vector in the cache memory.

7. The mobile device of claim 5 , further comprising:

means for receiving a third behavior vector from a network server; and

means for storing the third behavior vector in the cache memory.

8. The mobile device of claim 5 , further comprising:

means for transmitting a message to a server via a network connection to determine whether the second behavior vector matches a vector stored in a server memory of a service in response to determining that the second behavior vector does not match one of the behavior vectors stored in the cache memory; and

means for taking the corrective action in response to determining that the second behavior vector matches the vector stored in the server memory.

9. A non-transitory processor-readable storage medium having stored thereon processor-executable instructions configured to cause a processor of a mobile device to perform operations comprising:

populating a cache memory of the mobile device, comprising:

observing a first group of mobile device behaviors over a period of time;

determining whether the cache memory stores a behavior vector that corresponds an observed mobile device behavior; and

identifying a limited set of behaviors that are associated with operations that are inconsistent with normal operation patterns of the mobile device, receiving inputs regarding the limited set of behaviors, performing temporal and spatial correlations of the inputs, generating a first behavior vector based on a result of the spatial and temporal correlations, and storing the first behavior vector in the cache memory in response to determining that the cache memory does not store any behavior vectors that correspond to the observed mobile device behavior; and

performing behavior-based analysis operations, comprising:

observing a second group of mobile device behaviors;

generating a second behavior vector based on the second group of mobile device behaviors;

determining whether the second behavior vector matches one of the behavior vectors stored in the cache memory; and

taking a corrective action in response to determining that the second behavior vector matches one of the behavior vectors stored in the cache memory;

using the second behavior vector to determine whether one or more behaviors in the second group of mobile device behaviors are benign in response to determining that the second behavior vector does not match any of the behavior vectors stored in the cache memory; and

storing the second behavior vector in the cache memory in response to determining that one or more behaviors in the second group of mobile device behaviors are not benign.

10. The non-transitory processor-readable storage medium of claim 9 , wherein the stored processor-executable instructions are configured to cause a processor to perform operations further comprising:

receiving a third behavior vector from a second mobile device; and

storing the third behavior vector in the cache memory.

11. The non-transitory processor-readable storage medium of claim 9 , wherein the stored processor-executable instructions are configured to cause a processor to perform operations further comprising:

receiving a third behavior vector from a network server; and

storing the third behavior vector in the cache memory.

12. The non-transitory processor-readable storage medium of claim 9 , wherein the stored processor-executable instructions are configured to cause a processor to perform operations further comprising:

transmitting a message to a server via a network connection to determine whether the second behavior vector matches a vector stored in a server memory of a service in response to determining that the second behavior vector does not match one of the behavior vectors stored in the cache memory; and

taking the corrective action in response to determining that the second behavior vector matches the vector stored in the server memory.

13. A method of improving performance on a mobile device, comprising:

populating a cache memory of the mobile device by:

observing, by a mobile device processor, a first group of mobile device behaviors over a period of time;

determining whether the cache memory stores a behavior vector that corresponds to an observed mobile device behavior; and

identifying a limited set of behaviors that are associated with operations that are inconsistent with normal operation patterns of the mobile device, receiving inputs regarding the limited set of behaviors, performing temporal and spatial correlations of the inputs, generating a first behavior vector based on a result of the spatial and temporal correlations, and storing the first behavior vector in the cache memory in response to determining that the cache memory does not store any behavior vectors that correspond to the observed mobile device behavior; and

performing behavior-based analysis operations comprising:

observing, by the mobile device processor, a second group of mobile device behaviors;

generating, by the mobile device processor, a second behavior vector based on the second group of mobile device behaviors;

determining, by the mobile device processor, whether the second behavior vector matches the behavior vectors stored in the cache memory;

taking, by the mobile device processor, a corrective action in response to determining that the second behavior vector matches one of the behavior vectors stored in the cache memory;

using, by the mobile device processor, the second behavior vector to determine whether one or more behaviors in the second group of mobile device behaviors are benign in response to determining that the second behavior vector does not match any of the behavior vectors stored in the cache memory; and

storing the second behavior vector in the cache memory in response to determining that one or more behaviors in the second group of mobile device behaviors are not benign.

14. The method of claim 13 , further comprising:

receiving, by the mobile device processor, a third behavior vector from a second mobile device; and

storing, by the mobile device processor, the third behavior vector in the cache memory.

15. The method of claim 13 , further comprising:

receiving, by the mobile device processor, a third behavior vector from a network server; and

storing, by the mobile device processor, the third behavior vector in the cache memory.

16. The method of claim 13 , further comprising:

determining, by the mobile device processor, whether the second behavior vector matches a vector stored in a server memory of a service accessible via a network connection in response to determining that the second behavior vector does not match one of the behavior vectors stored in the cache memory; and

taking, by the mobile device processor, the corrective action in response to determining that the second behavior vector matches the vector stored in the server memory.