Granted Patent B2

US 12,488,103 · App. 18/462,809 · Granted Dec 2, 2025

Inventors: Savino Dambra (Nice, FR); Platon Kotzias (Athens, GR); Leylya Yumer (Antibes, FR)

Assignee: GEN DIGITAL, INC.

G06F21/554G06F21/56H04L63/20

Abstract

Claims (43)

1 . A computer-implemented method for protecting against malicious application encounters, at least a portion of the method being performed by a computing device comprising one or more processors, the method comprising:

obtaining application data and feature data from a plurality of mobile devices;

identifying one or more malicious applications installed on each mobile device within the plurality of mobile devices;

determining, based on the application data, a user profile for each mobile device within the plurality of mobile devices;

assigning each mobile device within the plurality of mobile devices to a cluster based on the user profile identified for each mobile device within the plurality of mobile devices such that each cluster includes a subset of mobile devices from the plurality of mobile devices;

creating, based on the feature data, a security model for a particular cluster, wherein the feature data relates to a distribution of application signers or application categories by each mobile device within the subset of mobile devices and one or more feature classes from a subset of mobile devices from the plurality of mobile devices that are assigned to the particular cluster, the one or more feature classes including volume, diversity, updates, distribution, prevalence, or geography;

applying the security model to a selected mobile device from the plurality of mobile devices that is within the particular cluster; and

performing a security action on the selected mobile device based on an output of the security model.

2 . The method of claim 1 , wherein the application data includes an identification of the applications installed on each mobile device within the plurality of mobile devices.

3 . The method of claim 1 , wherein malicious applications include applications that install malware.

4 . The method of claim 1 , wherein the feature data also relates to a volume of online activity by each mobile device within the subset of mobile devices.

5 . The method of claim 1 , wherein the feature data also relates to a diversity of online behaviors by each mobile device within the subset of mobile devices.

6 . The method of claim 1 , wherein the feature data also relates to a number or frequency of software updates performed by each mobile device within the subset of mobile devices.

7 . The method of claim 1 , wherein the feature data also relates to a prevalence of applications installed by each mobile device within the subset of mobile devices.

8 . The method of claim 1 , wherein the feature data also relates to a geographical location of each mobile device within the subset of mobile devices.

9 . The method of claim 1 , wherein the security action includes providing recommendations for antivirus default settings on the selected mobile device.

10 . The method of claim 1 , wherein the security action includes automatically adjusting antivirus default settings on the selected mobile device.

11 . The method of claim 1 , wherein the security action includes increasing a scan level intensity on the selected mobile device.

12 . A computer-implemented method for protecting against malicious application encounters, at least a portion of the method being performed by a computing device comprising one or more processors, the method comprising:

obtaining application data and feature data from a plurality of mobile devices;

identifying one or more malicious applications installed on each mobile device within the plurality of mobile devices;

determining, based on the application data, a user profile for each mobile device within the plurality of mobile devices;

assigning each mobile device within the plurality of mobile devices to a cluster based on the user profile identified for each mobile device within the plurality of mobile devices such that each cluster includes a subset of mobile devices from the plurality of mobile devices;

creating, based on the feature data, a security model for a particular cluster, wherein the feature data relates to a prevalence of applications installed by each mobile device within the subset of mobile devices and one or more feature classes from a subset of mobile devices from the plurality of mobile devices that are assigned to the particular cluster, the one or more feature classes including volume, diversity, updates, distribution, prevalence, or geography;

applying the security model to a selected mobile device from the plurality of mobile devices that is within the particular cluster; and

performing a security action on the selected mobile device based on an output of the security model.

13 . The method of claim 12 , wherein the application data includes an identification of the applications installed on each mobile divide within the plurality of mobile devices.

14 . The method of claim 12 , wherein the feature data also relates to a diversity of online behaviors by each mobile device within the subset of mobile devices.

15 . The method of claim 12 , wherein the feature data also relates to a number or frequency of software updates performed by each mobile device within the subset of mobile devices.

16 . The method of claim 12 , wherein the feature data also relates to a prevalence of applications installed by each mobile device within the subset of mobile devices.

17 . The method of claim 12 , wherein the feature data also relates to a geographical location of each mobile device within the subset of mobile devices.

18 . The method of claim 12 , wherein the security action includes providing recommendations for antivirus default settings on the selected mobile device or automatically adjusting antivirus default settings on the selected mobile device.

19 . The method of claim 12 , wherein the security action includes increasing a scan level intensity on the selected mobile device.

20 . A computing device comprising:

one or more processors; and

one or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by the one or more processors, cause the computing device to perform a method for protecting against malicious application encounters, the method comprising:

obtaining application data and feature data from a plurality of mobile devices;

identifying one or more malicious applications installed on each mobile device within the plurality of mobile devices;

determining, based on the application data, a user profile for each mobile device within the plurality of mobile devices;

assigning each mobile device within the plurality of mobile devices to a cluster based on the user profile identified for each mobile device within the plurality of mobile devices such that each cluster includes a subset of mobile devices from the plurality of mobile devices;

creating, based on the feature data, a security model for a particular cluster, wherein the feature data relates to a distribution of application signers or application categories by each mobile device within the subset of mobile devices or a prevalence of applications installed by each mobile device within the subset of mobile devices and one or more feature classes from a subset of mobile devices from the plurality of mobile devices that are assigned to the particular cluster, the one or more feature classes including volume, diversity, updates, distribution, prevalence, or geography;

applying the security model to a selected mobile device form the plurality of mobile devices that is within the particular cluster; and

performing a security action on the selected mobile device based on an output of the security model.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (116)