Device deactivation based on behavior patterns

Abstract

Embodiments of a pattern-based control system are described that learn and apply device usage patterns to identify and disable devices exhibiting anomalous usage patterns. The system can learn normal usage patterns of a user or can learn anomalous usage patterns, such as typical usage patterns of a stolen device. Such learning can include manual or algorithmic recognition of several sets of specific usage conditions (e.g., location, setting changes, personal data access events, application events, IMU data, etc.), or training a machine learning model to recognize usage condition combinations or sequences. Constraints (e.g., specific times or locations) can specify situations in which anomalous pattern matching is enabled or disabled. Upon identifying an anomalous usage pattern, the system can disable the device, e.g., by permanently destroying physical components, semi-permanently disabling components, or by software locking or data encryption.

Description

Technical Field

[0001] This disclosure relates to identifying individual or category device usage patterns to automatically deactivate devices. Background Technology

[0002] It is estimated that more than 70 million mobile devices are stolen each year, and less than 7% are recovered. Furthermore, these devices are becoming increasingly valuable, often requiring thousands of dollars to replace. However, the cost of a stolen device often far exceeds its monetary value. The theft of personal information, financial information, credentials to other systems, etc., can far outweigh the cost of replacing the stolen hardware.

[0003] Numerous systems exist designed to combat device theft. For example, many devices employ encryption, authentication procedures, and biometrics to protect device data. However, the high value of the devices and the recoverable data available to device thieves leads to a year-on-year increase in the number of stolen devices. Attached Figure Description

[0004] Figure 1 It is a block diagram illustrating an overview of a device on which some implementation schemes can operate.

[0005] Figure 2 It is a block diagram that illustrates an overview of the environment in which some implementation schemes can operate.

[0006] Figure 3 This is a block diagram illustrating the components, which in some embodiments may be used in systems employing the disclosed technology.

[0007] Figure 4 This is a flowchart illustrating the process used in some implementations to learn and apply device usage patterns to disable potentially stolen devices.

[0008] Figure 5 This is a conceptual diagram illustrating instances of entities and operations used to learn abnormal device usage patterns and deactivate devices when abnormal device usage patterns are detected.

[0009] The technology described herein can be better understood by referring to the following detailed description in conjunction with the accompanying drawings, in which similar reference numerals indicate equivalent or functionally similar elements. Detailed Implementation

[0010] Embodiments of a pattern-based control system are described, which learns and applies device usage patterns to identify and deactivate devices exhibiting anomalous usage patterns (e.g., the pattern of a stolen device). In various embodiments, deactivating a device may include physically deactivating the device permanently, components that deactivate the device semi-permanently (e.g., requiring unauthorized third-party control for reactivation), or temporarily deactivating the device (e.g., through software locking or encryption, which can be reversed with a password or other authentication process).

[0011] In some implementations, the pattern-based control system can learn normal user usage patterns and deactivate the device when a usage pattern differing from the normal pattern by a threshold amount is detected. In other implementations, the pattern-based control system can learn abnormal usage patterns, such as the typical usage patterns of a stolen device, and deactivate the device when such an abnormal usage pattern is detected.

[0012] In some cases, pattern-based control systems can learn usage patterns as a set of values ​​for usage conditions (e.g., binary values ​​indicating whether a particular activity occurred, specific values ​​for options within an activity category, value ranges, etc.). In other implementations, pattern-based control systems can use usage condition values ​​as input to a machine learning model that can generate usage pattern matching estimates. The machine learning model can be trained to identify a “stolen device” based on usage patterns seen in other stolen devices or based on activities known to typically occur when a device is stolen (e.g., making multiple purchases, mining personal data, and swapping SIM cards). The machine learning model can also be trained to learn typical usage patterns of a particular user, for example, by monitoring device usage and applying activity as training data to the model (assuming the device has not been stolen) until the model has enough usage examples to develop the ability to identify typical usage patterns.

[0013] As used in this text, "machine learning model" or "model" refers to a construct trained on training data to predict or provide probabilities for new data items, regardless of whether the new data items are included in the training data. For example, training data may contain items with various parameters and assigned categories. New data items may have parameters that the model can use to assign categories to them. As another example, a model may be a probability distribution derived from the analysis of the training data. Examples of models include: neural networks, deep neural networks, support vector machines, decision trees, Pazen windows, Bayesian methods, probability distributions, and others. Models can be configured for various scenarios, data types, source and output formats.

[0014] In various implementations, pattern-based control systems can monitor a variety of current usage conditions. A pattern-based control system can determine a binary value indicating whether a specific activity is occurring, or identify individual values ​​or ranges of values ​​related to the activity. Such usage conditions may include values ​​such as location identification, settings changes, data access events (e.g., passwords, personal data), application usage or sequences, bandwidth usage events or patterns, device movement patterns (e.g., inertial measurement units or "IMU" data), SIM card change events, purchase events, identification of the current user's facial pattern, and so on.

[0015] In some implementations, users can apply constraints to deactivating the device, such as never deactivating the device when it is in a specific known location, enabling abnormal usage pattern matching in certain situations (e.g., when the user indicates that she is traveling), disabling checks for abnormal usage patterns in certain situations (e.g., if the device is lent to another user), enabling or disabling usage pattern matching at certain times of the day and / or on certain dates, etc.

[0016] In some implementations, pattern-based control systems may provide users with the option to deactivate the device upon detecting an aberrant usage pattern. For example, a pattern-based control system may provide one or more alerts via the device or by sending notifications to other accounts (e.g., email accounts or SMS messages to backup devices). The alerts may require authentication, after which the pattern-based control system may cancel the device deactivation. In some implementations, canceling the device deactivation may cause the pattern-based control system to change the matching aberrant usage pattern or retrain the machine model to prevent it from recognizing the usage pattern that triggered the notification.

[0017] Upon identifying an anomalous usage pattern (and without providing unauthorized control), a pattern-based control system may disable the device. In some embodiments, disabling the device involves permanently damaging physical components of the device. For example, a pattern-based control system may overload fuses, damage memory, or overheat the processor. In other embodiments, disabling the device includes components that semi-permanently disable the device, such as shutting down or disabling the device (e.g., memory) controller, disconnecting hardware components, etc. This semi-permanent disablement may require a third party (such as the manufacturer, network provider, etc.) to re-enable the device. In yet another embodiment, the disablement may be non-permanent, such as through software locking or encryption, and can be revoked through an authentication process. In some embodiments, the level of device disablement may be based on the severity of the anomalous activity or a confidence value matching the anomalous use. For example, if a pattern-based control system has a high confidence value for a stolen device, it may permanently disable the device, but with a lower threshold confidence value, the pattern-based control system may only semi-permanently disable the device.

[0018] Existing systems aim to reduce security exposure attributable to device theft. These systems rely on pre-established security policies, such as requiring strong passwords for sensitive applications, data encryption, or local sandboxing, or on remote control, such as remote credential removal or memory erasure when the device owner notifies them of the theft. However, these existing systems have several drawbacks. Pre-established security policies for security typically require users to adhere to guidelines such as not reusing passwords and not entering passwords where they might be monitored. Remote control systems require users to be aware that their device has been stolen and to contact (if they cannot access their stolen device) a remote device administrator to perform data removal. In addition to these security issues, neither type of existing system adequately deters device theft because the device still has significant value after typical actions that thieves can take, such as a simple factory reset, replacement of the storage system, and / or replacement of the SIM card.

[0019] The disclosed technology is expected to overcome these shortcomings of existing systems. By providing automatic device deactivation based on learned usage patterns, security is improved by no longer relying on user compliance with guidelines or timely administrator notification of theft. Instead, device deactivation occurs automatically when abnormal usage patterns are detected. Furthermore, by providing an automatic system for deactivating devices in ways that thieves cannot overcome (e.g., by damaging device hardware or disabling the hardware controller—actions that cannot be overcome by factory resets or replacing the storage system), the attractiveness of stealing devices is greatly reduced, and therefore device theft can be decreased.

[0020] The following diagrams provide a more detailed discussion of several implementation schemes. Figure 1 This is a block diagram illustrating an overview of an apparatus on which some embodiments of the disclosed technology may operate. The apparatus may include hardware components of apparatus 100 that learns usage patterns. The same apparatus 100 or another version of apparatus 100 may detect abnormal usage pattern matches and, unless a constraint is active or an unauthorized control occurs, deactivate apparatus 100. Apparatus 100 may include one or more input devices 120 that provide input to processor 110 (e.g., CPU, GPU, HPU, etc.) and notify it of actions. These actions may be mediated by a hardware controller that interprets signals received from the input devices and transmits information to processor 110 using a communication protocol. For example, input devices 120 may include a mouse, keyboard, touchscreen, infrared sensor, touchpad, wearable input device, camera- or image-based input device, microphone, or other user input device.

[0021] Processor 110 may be a single processing unit or multiple processing units distributed within a device or across multiple devices. Processor 110 may be coupled to other hardware devices, for example, using a bus, such as a PCI bus or SCSI bus. Processor 110 may communicate with the hardware controller of a device (e.g., display 130). Display 130 may be used to display text and graphics. In some embodiments, display 130 provides visual feedback to a user with graphics and text. In some embodiments, display 130 includes an input device as part of the display, such as when the input device is a touchscreen or equipped with an eye-tracking system. In some embodiments, the display is separate from the input device. Examples of display devices are: LCD screens, LED screens, projectors, holographic or augmented reality displays (e.g., heads-up displays or head-mounted displays), etc. Other I / O devices 140 may also be coupled to the processor, such as network cards, video cards, audio cards, USB, FireWire or other external devices, cameras, printers, speakers, CD-ROM drives, DVD drives, disk drives, or Blu-ray devices.

[0022] In some implementations, device 100 also includes a communication device capable of wireless or wired communication with network nodes. The communication device can use, for example, a TCP / IP protocol to communicate with another device or server over a network. Device 100 can utilize the communication device to operate distributed across multiple network devices.

[0023] Processor 110 can access memory 150 located within or across multiple devices. Memory includes one or more of various hardware devices for volatile and non-volatile storage, and may include both read-only memory and writable memory. For example, memory may include random access memory (RAM), various caches, CPU registers, read-only memory (ROM), and writable non-volatile memory such as flash memory, hard disk drive, floppy disk, CD, DVD, magnetic storage device, tape drive, etc. Memory is not a propagation signal detached from the underlying hardware; therefore, memory is non-transitory. Memory 150 may include program memory 160 storing programs and software such as operating system 162, pattern-based control system 164, and other application programs 166. Memory 150 may also include data memory 170, such as device usage modes, constraint settings, unauthorized access control notification templates, configuration data, settings, user options, or preferences, which can be provided to program memory 160 or any element of device 100.

[0024] Some implementations can operate with a wide range of other computing system environments or configurations. Examples of computing systems, environments, and / or configurations suitable for use with the technology include (but are not limited to) personal computers, server computers, handheld or laptop devices, cellular phones, wearable electronics, game consoles, tablet computers, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, or the like.

[0025] Figure 2 This is a block diagram outlining an environment 200 in which some embodiments of the disclosed technology may operate. Environment 200 may include one or more client computing devices 205A to 205D, instances of which may include device 100. Client computing devices 205 may operate in a networked environment using logical connections via network 230 to one or more remote computers (e.g., server computing devices).

[0026] In some embodiments, server 210 may be an edge server that receives client requests and coordinates the fulfillment of those requests through other servers (e.g., servers 220A to 220C). Server computing devices 210 and 220 may include computing systems, such as device 100. Although each server computing device 210 and 220 logically appears as a single server, each server computing device may constitute a distributed computing environment encompassing multiple computing devices located in the same or geographically disparate physical locations. In some embodiments, each server 220 corresponds to a group of servers.

[0027] Client computing device 205 and server computing devices 210 and 220 can each act as a server or client to other server / client devices. Server 210 can connect to database 215. Servers 220A to 220C can each connect to corresponding databases 225A to 225C. As discussed above, each server 220 can correspond to a group of servers, and each of these servers can share a database or have its own database. Databases 215 and 225 can store (e.g., preserve) information such as typical use of the device after theft, normal usage patterns, constraint settings, etc. Although databases 215 and 225 logically appear as a single unit, databases 215 and 225 can each be a distributed computing environment encompassing multiple computing devices, located within their corresponding servers, or located in the same or geographically different physical locations.

[0028] Network 230 can be a local area network (LAN) or a wide area network (WAN), but it can also be other wired or wireless networks. Network 230 can be the Internet or some other public or private network. Client computing device 205 can connect to network 230 via a network interface, for example, via wired or wireless communication. Although the connection between server 210 and server 220 is presented as a separate connection, these connections can be any kind of local, wide area, wired or wireless network, including network 230 or a separate public or private network.

[0029] Figure 3 This is a block diagram illustrating component 300, which in some embodiments can be used in systems employing the disclosed technology. Component 300 includes hardware 302, general-purpose software 320, and dedicated components 340. As discussed above, systems implementing the disclosed technology can use various hardware, including processing units 304 (e.g., CPU, GPU, APU, etc.), main memory 306, storage memory 308 (local storage device or as an interface to a remote storage device, such as storage device 215 or 225), and input / output devices 310. In various embodiments, storage memory 308 can be one or more of the following: a local device, an interface to a remote storage device, or a combination thereof. For example, storage memory 308 can be a group of one or more hard disk drives (e.g., a redundant array of independent disks (RAID)) accessible via a system bus, or it can be a cloud storage provider or other network storage device accessible via one or more communication networks (e.g., a network accessible storage (NAS) device, such as storage device 215 or a storage device provided via another server 220). Component 300 may be implemented in a client computing device (e.g., client computing device 205) or on a server computing device (e.g., server computing device 210 or 220).

[0030] General-purpose software 320 may include various application programs, including an operating system 322, a native program 324, and a basic input / output system (BIOS) 326. Special-purpose component 340 may be a sub-component of general-purpose software application 320, such as native program 324. Special-purpose component 340 may include a constraint controller 344, a usage pattern learning module 346, a usage pattern monitor 348, an overreach control module 350, a deactivation controller 352, and components such as interface 342 that can be used to provide a user interface, transmit data, and control the special-purpose component. In some embodiments, component 300 may be in a computing system distributed across multiple computing devices, or may be an interface to a server-based application executing one or more of the special-purpose components 340. Although depicted as a separate component, special-purpose component 340 may be a logical or other non-physical distinction within the functionality of a controller. For example, special-purpose component 340 may be an aspect of a controller residing on an application processor, modem processor, ASIC, FPGA, or the like. In some instances, the dedicated component 340 is a memory controller among the aforementioned components, represented as an IP block in a layout or design.

[0031] Constraint controller 344 can determine whether any constraint specifying a condition in which abnormal pattern matching is disabled or enabled is active. Instances of conditions specified by a constraint may include unsafe or safe geographical areas where abnormal pattern matching is enabled or disabled; unsafe or safe times where abnormal pattern matching is enabled or disabled; unsafe or safe dates where abnormal pattern matching is enabled or disabled; manual activation or deactivation of abnormal pattern matching, etc. Additional details regarding constraints from abnormal pattern matching are provided below regarding box 404 and software module 552.

[0032] Usage pattern learning module 346 can learn device usage patterns corresponding to normal use or commonly seen (or expected) on a stolen device by a specific user. In various embodiments, learning usage patterns may involve training a machine learning model using usage conditions labeled as targeted or not targeted to a specific user or labeled as occurring or not occurring on a stolen device. In other embodiments, learning usage patterns may involve manually selecting several sets of usage conditions or selecting usage conditions based on statistical analysis (e.g., adding a specific usage condition to a set of selected usage conditions if it occurs for more than a threshold amount of time). Additional details regarding learning usage patterns are provided below with regard to box 402 and software module 532.

[0033] The pattern monitor 348 can be used to obtain usage patterns (as a machine learning model or a set of usage conditions) learned by the usage pattern learning module 346. The pattern monitor 348 can also obtain the current usage conditions of the device 300 (e.g., obtained from component 320 via interface 342) and apply them to the obtained usage patterns to determine whether an anomalous usage pattern is occurring. Additional details regarding box 406, software module 554, and neural network 506 are provided below for monitoring current usage conditions for anomalous usage patterns.

[0034] When abnormal usage patterns are detected by pattern monitor 348, unauthorized access control module 350 can request unauthorized access control from the user, for example, by providing a notification on device 300 or by sending a message to another system, such as an email account, phone number, or device management system. If the user provides unauthorized access control within a set time limit, the device can be deactivated. Additional details regarding unauthorized access control provided by block 408 and software module 556 are provided below.

[0035] When an abnormal usage pattern is detected by the usage pattern monitor 348 and the unauthorized access control module 350 fails to receive unauthorized access control within a set time limit, the deactivation controller 352 can deactivate device 300. Deactivation device 300 may include physical components that permanently disable device 300, components that semi-permanently disable device 300 (e.g., requiring third-party unauthorized access control to re-enable), or temporary components that temporarily disable device 300 (e.g., via software locking or encryption). In some embodiments, the level of deactivation may be based on a mapping from an abnormal usage confidence value (provided by the usage pattern monitor 348) to a deactivation type. Additional details regarding deactivation devices are provided below with regard to box 410 and action 590.

[0036] Technical personnel in the relevant field understand that the above description Figures 1 to 3 The components described in each of the flowcharts discussed below can be modified in various ways. For example, the order of the logic can be rearranged, sub-steps can be executed in parallel, described logic can be omitted, other logic can be included, and so on. In some implementations, one or more of the components described above can perform one or more of the processes described below.

[0037] Figure 4This is a flowchart illustrating a process 400 in some embodiments for learning and applying device usage patterns to disable a potentially stolen device. Parts of process 400 may be executed at different times. In some embodiments, block 402 for learning device usage patterns may be executed incrementally as the user uses the device. In other embodiments, block 402 may be executed in advance using a set of training terms indicating whether a particular use is abnormal device use (e.g., for a stolen device). These cases allow process 400 to obtain a machine learning model by training it. In other cases, block 402 may be executed on a device different from the device executing blocks 404 through 412. For example, a remote device may train a machine learning model to identify usage patterns of a stolen device, and the machine learning model may be obtained by another device that uses the usage model to examine the usage patterns.

[0038] While in some cases, the normal processing elements and / or memory of the device may be used to execute portions of process 400, in other embodiments, dedicated security hardware may be used to execute at least some portions of process 400 (e.g., blocks 404 to 412), such as the processor and / or memory separate from said processor and / or memory used for normal operation of the device (e.g., performing normal operation of the operating system). This allows the device to monitor anomalous use, even in exceptional circumstances (e.g., factory reset). Similarly, in some embodiments, portions of process 400 may be executed remotely by providing the current usage conditions to a system performing anomalous use monitoring via a network. In some cases, the monitored device may include a default option to disable the device without periodically receiving verification from a remote system, thereby preventing thieves from simply disabling communication to overcome the device deactivation procedure.

[0039] At box 402, process 400 can learn device usage patterns. Device usage patterns can be based on usage conditions such as current location, changes to settings, specific data access events (e.g., password or personal data access), application usage, bandwidth patterns, physical device movement (e.g., IMU data), SIM card change events, financial events (e.g., e-commerce purchases), current user facial recognition data, other user I / O events, network traffic, etc. Usage patterns can be typical usage patterns (e.g., typical usage by a specific user) or anomalous usage patterns (e.g., typical usage by a stolen device).

[0040] In some implementations, device usage patterns can be learned by training a machine learning model to identify when usage conditions reach normal or anomalous usage patterns. In some implementations, the machine learning model may be a neural network with multiple input nodes that receive usage conditions. Input nodes may correspond to functions that receive input and produce results. These results can be provided to one or more levels of intermediate nodes, each producing further results based on combinations of results from lower-level nodes. Weighting factors may be applied to the output of each node before passing the results to the next layer of nodes. At the final layer (“output layer”), one or more nodes may produce values ​​that classify the inputs, which can be used to measure whether the usage is typical or anomalous once the model has been trained to identify typical or anomalous usage patterns. As another example, the machine learning model may be a deep neural network and / or portions of the neural network may have internal states, allowing the neural network to recognize usage patterns over time (e.g., a recurrent neural network) or perform convolutions (e.g., a convolutional neural network). In some implementations, a neural network can be trained to identify anomalous usage patterns using training data containing input usage conditions performed by a normal user (mapped to typical usage output) and training data containing activities observed in a stolen device or expected to be performed in a stolen device (mapped to anomalous output). In other cases, the model can be trained to identify the usage of a specific user, where the training terms can be the user's monitored usage conditions mapped to outputs indicating normal usage. During training, representations of the input usage conditions (e.g., as feature vectors) can be provided to the neural network. The output from the neural network can be compared to the expected output mapped to the training terms, and based on the comparison, the neural network can be modified, for example, by changing the weights between nodes in the neural network and / or the parameters of the function used at each node in the neural network or the parameters between layers in a deep neural network. After applying each of the training terms and modifying the neural network in this way, the neural network model can be trained to evaluate the new usage pattern to determine whether it is normal or anomalous.

[0041] In some implementations, as an alternative to or supplement to machine learning models, at block 402, a pattern-based control system can learn device usage patterns as a set of usage conditions. For example, an abnormal usage pattern could be set to a change of location in an area that has never been accessed before, combined with a password database access, followed by a factory reset.

[0042] In user-specific implementations where learned device usage patterns have been established, the learned usage patterns can be reset, allowing the device to be transferred to a new user to learn new typical usage patterns. This reset process may occur after various security features (e.g., passwords, biometrics) or may require a third-party connection (e.g., a network provider or device manufacturer) to perform the usage pattern reset.

[0043] If the usage pattern is learned on the device rather than where it will be applied, then the device usage pattern can be, for example, preloaded into the device by the device manufacturer or provided to the device via a network.

[0044] At box 404, process 400 determines whether a constraint is active. A constraint can limit when a pattern-based control system will perform abnormal device use checks. For example, a user may be able to configure settings to explicitly enable or disable pattern matching, or to automatically enable or disable pattern matching. For instance, a user may lend their device to another user but not want abnormal use by that user to trigger device deactivation. In this example, the user may toggle a setting that instructs the pattern-based control system to stop checking for abnormal usage patterns until the setting is toggled back. As another example, a user may establish secure geographical zones where abnormal pattern matching is disabled (e.g., at home, workplace, or automatically learned locations based on the user's schedule), or insecure zones where abnormal pattern matching is enabled (e.g., while traveling or in locations outside the user's regular schedule). Similarly, a user may establish secure or insecure times or dates to enable or disable abnormal pattern matching (e.g., a user may enable pattern matching for dates while traveling, or a pattern-based control system may automatically identify events on the user's calendar that are more likely to be theft-related). In some scenarios, pattern-based control systems can automatically identify conditions with high security risks (e.g., increased likelihood of theft) (e.g., based on current location, calendar events, or other scenarios) and prompt the user to activate anomalous pattern matching. If the constraint is active (preventing anomalous pattern matching), process 400 may remain at box 404 until the constraint is closed. If such a constraint is inactive, process 400 may proceed to box 406. In some implementations, constraint checking is not used, and process 400 may skip box 404 and proceed directly to box 406.

[0045] At box 406, process 400 may detect whether abnormal device use has occurred. Depending on the type of device use pattern learned at box 402, comparing the current use condition with the use pattern may include determining a threshold match between the current use condition and a set of use conditions learned at box 402, or applying the current use condition to a machine learning model trained at box 402. In various embodiments, identifying abnormal device use may include determining that the current use condition does not sufficiently match a normal use pattern, or it may include determining that the current use condition sufficiently matches an abnormal use pattern.

[0046] In some implementations, more than one device usage pattern may be used. For example, process 400 may have identified an anomalous device usage pattern of the stolen device and a typical usage pattern of a particular user (e.g., a separate machine learning model trained for each). Process 400 may combine the outputs from these two usage patterns to determine whether anomalous device use has occurred, for example, by determining anomalous use when either model provides a confidence value above a threshold, when both models provide confidence values ​​above a threshold, or when the average determination of the two models is above a threshold. In some cases, the outputs of each of the two models may be weighted, for example, by static values ​​or by using a third model trained to identify the weights of the outputs of each of the other two models based on the input of the usage conditions. For example, based on the current usage conditions, the "stolen" model may produce a 73% positive estimate that the device has been stolen, the "typical use" model may produce an 87% estimate that the current usage conditions indicate anomalous use, and the "weighted model" may assign 61% weight to the "typical use" model and 39% weight to the "stolen" model for the current usage conditions. Therefore, the overall result can be 73% * 39% + 87% * 61% = 81.54%. In this example, the threshold for abnormal use can be 80%, so the result will determine that abnormal use is occurring. If no abnormal device use is detected, then process 400 can return to box 404, but if abnormal device use is detected, then process 400 can continue to box 408.

[0047] At box 408, process 400 may determine whether unauthorized access control for deactivating the device has been provided. In response to detected aberrant device use, process 400 may provide a warning on the device or to a separate system (e.g., a designated email account, a device administrator, via SMS to a backup device, etc.) that aberrant device use has been detected, and the device will automatically deactivate unless unauthorized access control is provided within a threshold time period (e.g., 30 seconds, 1 minute, 2 minutes, or 5 minutes, etc.). Providing unauthorized access control may include entering a master password, providing a biometric read, performing two-factor authentication, etc. In some cases, the provided unauthorized access control may indicate that the aberrant use match at box 406 is incorrect, and therefore process 400 may retain a learned device use pattern with additional training data containing the current usage conditions as a counterexample to aberrant use. If unauthorized access control is provided, then process 400 may return to box 404; however, if unauthorized access control is not provided, process 400 may continue to box 410. In some implementations, no unauthorized access control checks are used, and process 400 can skip box 408 and proceed directly to box 410.

[0048] At box 410, process 400 may deactivate the device detected as having anomalous use. Deactivation can be, in various senses, a permanent deactivation of hardware, a semi-permanent deactivation of data other than that stored in the device's memory, or a change in settings or other memory configurations. For example, permanently deactivating hardware might include overloading fuses, damaging memory, or overheating the processor. Semi-permanent deactivation might include shutting down or disconnecting hardware or deactivating the hardware controller. Deactivation by changing settings or other memory configurations might include encrypting the drive, locking the device, or deleting specific sensitive information. In some implementations, the type of deactivation that occurs may be based on a confidence score of the likelihood that the device has been stolen, as determined at box 406. For example, a machine learning model might produce a value between 0 and 1, where the closer the value is to 1, the more confident the model is that the current usage conditions indicate anomalous (or normal, depending on how the model was trained) use. Various thresholds of the confidence value can be mapped to different types of deactivation; for example, a higher confidence value indicating that the current use indicates the device has been stolen results in a more persistent deactivation.

[0049] At box 412, process 400 may provide an alert that the device has been deactivated. For example, a designated email account, phone number, or other system (e.g., an employer information security system) may receive a notification that the device has been deactivated. In some implementations, the alert may also provide the usage conditions that led to the device deactivation and / or instructions to reactivate the device. Process 400 may then terminate. In some implementations, no deactivation alert is provided, and process 400 may skip box 412.

[0050] Figure 5This is a conceptual diagram illustrating an instance 500 for learning abnormal device usage patterns and deactivating the device when an abnormal usage pattern is detected. Instance 500 includes a stolen device 502, a monitored device 504, and a neural network 506. Instance 500 also demonstrates software modules including a module 532 for identifying usage patterns to train the neural network 506, a module 552 for applying constraints, a module 554 for using the neural network 506 to monitor usage patterns, and a module 556 for requesting deactivation of unauthorized control.

[0051] Example 500 begins at module 532, where, at action 572, usage conditions relating to the stolen device 502 are received. These usage conditions are a set (not shown) of many usage conditions received from various stolen devices. Additionally, other usage conditions (also not shown) from devices in normal operation are obtained. In action 574, these sets of usage conditions with corresponding labels from both stolen and unstolen devices are provided to train neural network 506. Training may involve providing each set of usage conditions as input to neural network 506 and adjusting the parameters of neural network 506 based on how closely the output of neural network 506 matches the labels of the usage condition sets (e.g., using backpropagation).

[0052] Once trained, neural network 506 can be used by device 504 to monitor abnormal (stolen device) usage patterns. Example 500 continues at action 582, where module 552 checks constraints, such as not monitoring usage patterns when in a secure zone, during a selected time period, and when the user has turned off mode monitoring. When no constraint indicates mode monitoring is disabled, example 500 continues to action 584, where module 554 determines the current usage conditions and provides them to the trained neural network 506 at action 586. At action 588, the trained neural network 506 provides a determination of whether the current usage conditions indicate an abnormal usage pattern. In this example, an abnormal usage pattern has been identified, so module 556 requests unauthorized control from the user, in this case, by locking the device and prompting the user to enter the master password previously set on the device. If the master password has not been received after a 20-second threshold, example 500 continues to action 590, where device 504 is disabled. In Example 500, disabling the device involves disabling the processor, erasing the hard drive, and damaging the memory of device 504. Device 504 is now much less useful to thieves, and because the confidential data it contains has been removed, the security threat is also much smaller.

[0053] The foregoing description, with reference to the accompanying drawings, outlines several embodiments of the disclosed technology. A computing device on which the described technology can be implemented may include one or more central processing units, memory, input devices (e.g., keyboard and pointing devices), output devices (e.g., display devices), storage devices (e.g., disk drives), and network devices (e.g., network interfaces). The memory and storage devices are computer-readable storage media that can store at least a portion of the instructions for implementing the described technology. Additionally, data structures and message structures may be stored or transmitted via data transmission media (e.g., signals on a communication link). Various communication links may be used, such as the Internet, local area networks, wide area networks, or point-to-point dial-up connections. Therefore, computer-readable media may include computer-readable storage media (e.g., "non-transitory" media) and computer-readable transmission media.

[0054] In this specification, references to "implementation" (e.g., "some implementations," "various implementations," "one implementation," "implementation," etc.) mean that a particular feature, structure, or characteristic described in connection with said implementation is included in at least one implementation of this disclosure. The appearance of these phrases in various places in the specification does not necessarily refer to the same implementation, nor does it necessarily refer to a single or alternative implementation that is mutually exclusive with other implementations. Furthermore, various features may be described by some implementations but not others. Similarly, various requirements are described, which may be requirements for some implementations but not for other implementations.

[0055] As used herein, above the threshold means that the value of the compared item is higher than other specified values, the compared item is among a specified number of items with a maximum value, or the compared item has a value within a specified top percentage value. As used herein, below the threshold means that the value of the compared item is lower than other specified values, the compared item is among a specified number of items with a minimum value, or the compared item has a value within a specified bottom percentage value. As used herein, within the threshold means that the value of the compared item is between two other specified values, the compared item is between a specified number of items in the middle, or the compared item has a value within a specified middle percentage range. When not otherwise defined, relative terms (such as high or unimportant) can be understood as assigning a value and determining how the value is compared to the established threshold. For example, the phrase "select fast connection" can be understood as meaning selecting a connection with a value assigned to its connection speed corresponding to a value above the threshold.

[0056] As used in this article, the word "or" refers to any possible permutation of a set of items. For example, the phrase "A, B, or C" refers to at least one of A, B, C, or any combination thereof, such as any of the following: A; B; C; A and B; A and C; B and C; A, B, and C; or any multiple of the items, such as A and A; B, B, and C; A, A, B, C, and C; and so on.

[0057] Although the subject matter has been described in language specific to structural features and / or methodological actions, it should be understood that the subject matter as defined in the appended claims is not necessarily limited to the specific features or actions described above. Specific embodiments and implementations have been described herein for illustrative purposes, but various modifications may be made without departing from the scope of the embodiments and implementations. The specific features and actions described above are disclosed as examples of implementing the appended claims. Therefore, the embodiments and implementations are not limited beyond the appended claims.

[0058] Any of the foregoing patents, patent applications, and other references are incorporated herein by reference. Modifications may be made where necessary to provide alternative embodiments using the systems, functions, and concepts described in the various references above. In the event of any conflict between a statement or subject matter in a document incorporated by reference and a statement or subject matter of this application, this application shall prevail.

Claims

1. A method comprising: At the memory of the mobile device, data representing a machine learning model trained to identify usage patterns of the mobile device is received; Evaluate one or more sets of constraints that specify one or more cases in which abnormal pattern matching is disabled, and based on the evaluation, determine that none of the constraints from the set of constraints are active; In response to the determination that the constraint is not active, the abnormal usage pattern is determined to be occurring by applying the machine learning model to the current usage conditions of the mobile device to identify the usage pattern of the mobile device. Request the user of the mobile device to disable unauthorized control; as well as In response to the determination that the abnormal usage pattern is occurring and no deactivation control is received, one or more physical components of the mobile device are permanently disabled. The set of one or more constraints includes insecure dates where anomalous pattern matching is enabled; and At least some of the unsafe dates are based on events automatically identified on the user's calendar.

2. The method according to claim 1, The machine learning model is trained based on observed user activity to identify the user's normal usage patterns; and Determining that the abnormal usage pattern is occurring includes determining a threshold match from the output of the machine learning model indicating that the current usage conditions are lower than the user's normal usage pattern.

3. The method according to claim 1, The machine learning model is trained to identify the abnormal usage patterns corresponding to the usage conditions of the stolen device; and Determining that the abnormal usage pattern is occurring includes determining that the output from the machine learning model indicates a threshold match where the current usage conditions are higher than the usage conditions of the stolen device.

4. The method of claim 1, wherein the current usage condition includes values ​​of three or more of the following: Location identification; Settings changed; Personal data access events; Application usage or sequence; IMU device mobile mode; SIM card change events; Purchase event; or Any combination thereof.

5. The method of claim 1, wherein the set of one or more constraints comprises one or more of the following: Among them, the safe geographical zone for matching abnormal patterns is disabled; Among them, the safe time of day for abnormal pattern matching is disabled; Among them, the safe date for disabling abnormal pattern matching; or Any combination thereof.

6. The method according to claim 1, The set of one or more constraints includes manual activation of anomalous pattern matching; and The manual activation for abnormal pattern matching is a response to a prompt provided to the user in response to the automatic identification of conditions with high security risks.

7. The method according to claim 1, The machine learning model mentioned above is a first machine learning model trained to identify usage conditions corresponding to the stolen device; The method further includes obtaining a second machine learning model trained to identify usage conditions corresponding to normal use by the user; and The determination that the abnormal usage pattern is occurring includes: The first machine learning model is applied to the current usage conditions of the mobile device to generate a first value that estimates the current usage conditions as a first probability that the mobile device has been stolen. The second machine learning model is applied to the current usage conditions of the mobile device to generate a second value that estimates the second probability of the current usage conditions corresponding to the user's normal device actions; The results based on the first and second values ​​are combined to form a combined anomaly usage prediction; and The combined abnormal usage prediction is determined to be higher than the abnormal usage pattern threshold.

8. The method according to claim 7, The method further includes obtaining a third machine learning model, which is trained to identify weights between the results based on the first value and the second value based on providing the current usage conditions to the third machine learning model; and The combination of the results mentioned above includes: The current usage conditions are provided to the third machine learning model to obtain the weights; Apply the weights to the results based on the first and second values; and The weighted results are combined into the combined anomaly usage prediction.

9. The method of claim 1, wherein at least the determination that the abnormal usage pattern is occurring and the permanent deactivation of the mobile device, the one or more physical components, are controlled by a second processing component separate from a first processing component executing the operating system of the mobile device.

10. The method according to claim 1, The request to disable unauthorized access control includes sending a message to a computing system other than the mobile device, and setting a timer for receiving the unauthorized access control; and In response to the expiration of the timer, one or more physical components of the mobile device are permanently deactivated.

11. The method according to claim 1, The application of the machine learning model includes receiving confidence values ​​from the machine learning model indicating the likelihood that the anomalous usage pattern is occurring; and The permanent deactivation of one or more physical components of the mobile device is performed in response to comparing the confidence value with a threshold; if the confidence value is higher than the threshold, the mobile device is permanently deactivated, and if the confidence value is lower than the threshold, the mobile device is non-permanently deactivated.

12. A computing system for disabling a device that displays abnormal usage patterns, the computing system comprising: One or more processors; as well as One or more memories storing instructions that, when executed by the computing system, cause the one or more processors to perform operations including: Receive data representing a machine learning model trained to identify the anomalous usage patterns; Evaluate one or more sets of constraints that specify one or more cases in which abnormal pattern matching is disabled, and based on the evaluation, determine that none of the constraints from the set of constraints are active; In response to the fact that none of the defined constraints are active, the abnormal usage pattern is determined to be occurring by applying the machine learning model to the current usage conditions of the device; Request the user associated with the device to disable unauthorized control; as well as In response to the determination that the abnormal usage pattern is occurring and no deactivation authorization control has been received, one or more physical components of the device are permanently disabled. The set of one or more constraints includes insecure dates where anomalous pattern matching is enabled; and At least some of the unsafe dates are based on events automatically identified on the user's calendar.

13. The computing system according to claim 12, The machine learning model is trained to identify abnormal usage patterns corresponding to the conditions under which the stolen device is used; and Determining that the abnormal usage pattern is occurring includes determining that the output from the machine learning model indicates a threshold match where the current usage conditions are higher than the usage conditions of the stolen device.

14. The computing system of claim 12, wherein the current usage conditions include values ​​of two or more of the following: Location identification; Settings changed; Personal data access events; Application usage or sequence; IMU device mobile mode; SIM card change event; or Any combination thereof.

15. The computing system of claim 12, wherein the operation further comprises: Evaluate one or more constraints that specify one or more cases where abnormal pattern matching is disabled; Based on the assessment, it is determined that none of the constraints from the set of constraints are active, and in response, abnormal usage pattern matching is enabled.

16. The computing system of claim 15, wherein the set of one or more constraints includes one or more of the following: Among them, the safe geographical zone for matching abnormal patterns is disabled; Among them, the safe time of day for abnormal pattern matching is disabled; Among them, the safe date for disabling abnormal pattern matching; or Any combination thereof.

17. The computing system according to claim 15, The set of one or more constraints includes manual activation of anomalous pattern matching; and The manual activation for abnormal pattern matching is a response to a prompt provided to the user in response to the automatic identification of conditions with high security risks.

18. A non-transitory computer-readable storage medium storing instructions, said instructions, when executed by a computing system, causing the computing system to perform operations for disabling a device, said operations including: Obtain a machine learning model trained to identify usage patterns; Determine that none of the constraints from a specified set of one or more constraints in which abnormal pattern matching is disabled are active; In response to the determination that none of the constraints are active, an abnormal usage pattern is determined to be occurring by applying the machine learning model to the current usage conditions of the device to identify the usage pattern of the mobile device. Request the user of the mobile device to disable unauthorized control; as well as In response to the determination that the abnormal usage pattern is occurring and no deactivation authorization control has been received, one or more physical components of the device are permanently disabled. The set of one or more constraints includes insecure dates where anomalous pattern matching is enabled; and At least some of the unsafe dates are based on events automatically identified on the user's calendar.

19. The non-transitory computer-readable storage medium according to claim 18, The application of the machine learning model includes receiving confidence values ​​from the machine learning model indicating the likelihood that the anomalous usage pattern is occurring; and Deactivating the device includes permanently deactivating the device in response to comparing the confidence value with a threshold, wherein the device is permanently deactivated if the confidence value is higher than the threshold, and the device is non-permanently deactivated if the confidence value is lower than the threshold.

Images