Methods and systems for aggregated multi-application behavioral analysis of mobile device behaviors

1. A method of analyzing a behavior of a computing device, comprising:

monitoring, in a processor of the computing device, activities and interactions between a plurality of software applications on the computing device to collect behavior information;

aggregating behavior information collected from multiple individual software applications;

generating a behavior vector information structure that includes a plurality of numerical values that characterize a collective behavior of two or more of the plurality of software applications based on the aggregated behavior information;

applying the generated behavior vector information structure to a multi-application classifier model to evaluate each test condition included in the multi-application classifier model and generate analysis information, wherein each test condition in the multi-application classifier model tests a condition relevant to evaluating a relationship between two or more of the plurality of software applications;

using the generated analysis information to:

categorize the monitored plurality of software applications;

generating performance numbers for each category of the plurality of software applications;

determine whether two or more of the plurality of software applications are working in concert;

evaluate the collective behavior of two or more of the plurality of software applications; and

generate evaluation results; and

determining whether the collective behavior is non-benign based on the generated evaluation results.

2. The method of claim 1 , wherein generating the behavior vector information structure that includes the plurality of numerical values that characterize the collective behavior of two or more of the plurality of software applications based on the aggregated behavior information comprises generating an information structure that characterizes the collective behavior of all of the software applications in the plurality of software applications via the plurality of numerical values.

3. The method of claim 1 , wherein generating the behavior vector information structure that includes the plurality of numerical values that characterize the collective behavior of two or more of the plurality of software applications based on the aggregated behavior information comprises generating an information structure that characterizes the relationship between two or more of the plurality of software applications via the plurality of numerical values.

4. The method of claim 1 , wherein using the generated analysis information further comprises identifying two or more software applications that should be evaluated together as a group.

5. The method of claim 4 , further comprising:

monitoring additional activities of the identified two or more software applications to collect additional behavior information;

generating a collective behavior vector that characterizes the collective behavior of the identified two or more software applications based on the collected additional behavior information;

applying the generated collective behavior vector to the multi-application classifier model to generate additional analysis information; and

using the additional analysis information to determine whether the collective behavior of the identified two or more software applications is non-benign.

6. The method of claim 4 , further comprising:

applying behavior vectors that each characterizes the behavior of the identified two or more software applications to the multi-application classifier model to generate additional analysis information;

aggregating the additional analysis information generated for each of the behavior vectors; and

using the aggregated analysis information to determine whether the collective behavior of the identified two or more software applications is non-benign.

7. The method of claim 1 , further comprising:

computing a weighted average of each result of evaluating test conditions in the multi-application classifier model;

wherein determining whether the collective behavior is non-benign based on the generated evaluation results comprises determining whether the collective behavior is non-benign based on the weighted average.

8. The method of claim 1 , wherein using the generated analysis information further comprises profiling each category of the plurality of software applications.

9. A computing device, comprising:

a processor configured to:

monitor activities and interactions between a plurality of software applications on the computing device to collect behavior information;

aggregate behavior information collected from multiple individual software applications;

generate a behavior vector information structure that includes a plurality of numerical values that characterize a collective behavior of two or more of the plurality of software applications based on the aggregated behavior information;

apply the generated behavior vector information structure to a multi-application classifier model to evaluate each test condition included in the multi-application classifier model and generate analysis information, wherein each test condition in the multi-application classifier model tests a condition relevant to evaluating a relationship between two or more of the plurality of software applications;

use the generated analysis information to:

categorize the monitored plurality of software applications;

generating performance numbers for each category of the plurality of software applications;

determine whether two or more of the plurality of software applications are working in concert;

evaluate the collective behavior of two or more of the plurality of software applications; and

generate evaluation results; and

determine whether the collective behavior is non-benign based on the generated evaluation results.

10. The computing device of claim 9 , wherein the processor is further configured with processor-executable instructions to generate the behavior vector information structure that includes the plurality of numerical values that characterize the collective behavior of two or more of the plurality of software applications based on the collected aggregated behavior information by generating an information structure that characterizes the collective behavior of all of the software applications in the plurality of software applications via the plurality of numerical values.

11. The computing device of claim 9 , wherein the processor is further configured with processor-executable instructions to generate the behavior vector information structure that includes the plurality of numerical values that characterize the collective behavior of two or more of the plurality of software applications based on the aggregated behavior information by generating an information structure that characterizes a relationship between two or more of the plurality of software applications via the plurality of numerical values.

12. The computing device of claim 9 , wherein the processor is further configured with processor-executable instructions such that using the generated analysis information further comprises identifying two or more software applications that should be evaluated together as a group.

13. The computing device of claim 12 , wherein the processor is further configured with processor-executable instructions to:

monitor additional activities of the identified two or more software applications to collect additional behavior information;

generate a collective behavior vector that characterizes the collective behavior of the identified two or more software applications based on the collected additional behavior information;

apply the generated collective behavior vector to the multi-application classifier model to generate additional analysis information; and

use the additional analysis information to determine whether the collective behavior of the identified two or more software applications is non-benign.

14. The computing device of claim 12 , wherein the processor is further configured with processor-executable instructions to:

apply behavior vectors that each characterizes a behavior of the identified two or more software applications to the multi-application classifier model to generate additional analysis information;

aggregate the additional analysis information generated for each of the behavior vectors; and

use the aggregated analysis information to determine whether the collective behavior of the identified two or more software applications is non-benign.

15. The computing device of claim 9 , wherein:

the processor is further configured with processor-executable instructions to compute a weighted average of each result of evaluating test conditions in the multi-application classifier model; and

the processor is configured with processor-executable instructions to determine whether the collective behavior is non-benign based on the generated evaluation results by determining whether the collective behavior is non-benign based on the weighted average.

16. The computing device of claim 9 , wherein the processor is configured with processor-executable instructions such that using the analysis information further comprises profiling each category of the plurality of software applications.

17. The computing device of claim 9 , further comprising a behavior observer hardware module configured to monitor use of computing device memory and hardware events at a hardware level and output collected behavior information to the processor, wherein the processor is configured with processor-executable instructions to monitor the activities of the plurality of software applications by receiving the collected behavior information from the behavior observer hardware module.

18. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor in a computing device to perform operations comprising:

monitoring activities and interactions between a plurality of software applications on the computing device to collect behavior information;

aggregating behavior information collected from multiple individual software applications;

generating a behavior vector information structure that includes a plurality of numerical values that characterize a collective behavior of two or more of the plurality of software applications based on the aggregated behavior information;

applying the generated behavior vector information structure to a multi-application classifier model to evaluate each test condition included in the multi-application classifier model and generate analysis information, wherein each test condition in the multi-application classifier model tests a condition relevant to evaluating a relationship between two or more of the plurality of software applications;

using the generated analysis information to:

categorize the monitored plurality of software applications;

generating performance numbers for each category of the plurality of software applications;

determine whether two or more of the plurality of software applications are working in concert;

evaluate the collective behavior of two or more of the plurality of software applications; and

generate evaluation results; and

determining whether the collective behavior is non-benign based on the generated evaluation results.

19. The non-transitory computer readable storage medium of claim 18 , wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that generating the behavior vector information structure that includes the plurality of numerical values that characterize the collective behavior of two or more of the plurality of software applications based on the aggregated behavior information comprises generating an information structure that characterizes the collective behavior of all of the software applications in the plurality of software applications via the plurality of numerical values.

20. The non-transitory computer readable storage medium of claim 18 , wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that generating the behavior vector information structure that includes the plurality of numerical values that characterize the collective behavior of two or more of the plurality of software applications based on the aggregated behavior information comprises generating an information structure that characterizes a relationship between two or more of the plurality of software applications via the plurality of numerical values.

21. The non-transitory computer readable storage medium of claim 18 , wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that using the generated analysis information further comprises identifying two or more software applications that should be evaluated together as a group.

22. A computing device, comprising:

means for monitoring activities and interactions between a plurality of software applications on the computing device to collect behavior information;

means for aggregating behavior information collected from multiple individual software applications;

means for generating a behavior vector information structure that includes a plurality of numerical values that characterize a collective behavior of two or more of the plurality of software applications based on the aggregated behavior information;

means for applying the generated behavior vector information structure to a multi-application classifier model to evaluate each test condition included in the multi-application classifier model and generate analysis information, wherein each test condition in the multi-application classifier tests a condition relevant to evaluating a relationship between of two or more of the plurality of software applications;

means for using the generated analysis information to:

categorize the monitored plurality of software applications;

generating performance numbers for each category of the plurality of software applications;

determine whether two or more of the plurality of software applications are working in concert;

evaluate the collective behavior of two or more of the plurality of software applications; and

generate evaluation results; and

means for determining whether the collective behavior is non-benign based on the generated evaluation results.

23. The computing device of claim 22 , wherein means for generating the behavior vector information structure that includes the plurality of numerical values that characterize the collective behavior of two or more of the plurality of software applications based on the aggregated behavior information comprises means for generating an information structure that characterizes the collective behavior of all of the software applications in the plurality of software applications via the plurality of numerical values.

24. The computing device of claim 22 , wherein means for generating the behavior vector information structure that includes the plurality of numerical values that characterize the collective behavior of two or more of the plurality of software applications based on the aggregated behavior information comprises means for generating an information structure that characterizes a relationship between two or more of the plurality of software applications via the plurality of numerical values.

25. The computing device of claim 22 , wherein

means for using the generated analysis information further comprises means for identifying two or more software applications that should be evaluated together as a group.

26. The computing device of claim 25 , further comprising:

means for monitoring additional activities of the identified two or more software applications to collect additional behavior information;

means for generating a collective behavior vector that characterizes the collective behavior of the identified two or more software applications based on the collected additional behavior information;

means for applying the generated collective behavior vector to the multi-application classifier model to generate additional analysis information; and

means for using the additional analysis information to determine whether the collective behavior of the identified two or more software applications is non-benign.