Mobile App Execution State Inference via Behavioral Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional solutions for determining the execution state of software applications on mobile devices rely on operating system-provided information, which may be inaccurate or insufficient, especially when dealing with malicious applications or malware, leading to ineffective power management and behavioral analysis.
Innovation Solution
A mobile device equipped with a state estimation and prediction module that uses machine learning techniques to independently determine the execution state of software applications by monitoring various software and hardware components, generating more accurate and detailed execution state information that is not dependent on operating system or application-provided data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If operating system-provided execution state information is used, then power management and behavioral analysis can be performed, but the accuracy is insufficient especially for malicious applications
Solution Approach 1:
The patent introduces an intermediary execution state determination module that independently analyzes actual device behavior (CPU usage, memory access, sensor activity) to determine true execution state, rather than relying on OS-provided information. This intermediary layer acts as a mediator between the application and the power management/behavioral analysis systems, providing accurate execution state information even for malicious applications that attempt to deceive the OS.
Solution Approach 2:
The patent replaces the mechanical/trust-based system where applications report their own state to the OS with an observational system that infers execution state from actual device behavior patterns. Instead of relying on self-reported information (analogous to trusting a mechanical indicator), the system uses machine learning to analyze multiple behavioral signals and determine the true execution state, making it resistant to deception by malicious applications.
2Measurement precision
If independent execution state determination is implemented, then accuracy improves, but device complexity increases
Solution Approach 1:
The execution state determination module serves multiple functions simultaneously: it provides accurate execution state information for power management, enables behavioral analysis for security, supports application optimization, and facilitates resource allocation. By making this component universal and multi-functional, the patent reduces the need for separate systems, thereby mitigating the increase in device complexity while achieving high measurement precision.
Solution Approach 2:
The system uses the mobile device's own existing operational data (CPU usage, memory access patterns, sensor activity) to determine execution state, rather than requiring external monitoring systems or additional specialized hardware. The execution state determination module self-services by leveraging already-collected behavioral information from the device's normal operation, reducing complexity through resourcefulness.
3Measurement precision
If detailed behavior monitoring is performed, then behavioral analysis accuracy improves, but power consumption increases
Solution Approach 1:
The system performs preliminary analysis by identifying patterns and correlations in behavioral data during normal operation, building execution state determination models in advance. By pre-processing and pre-analyzing behavioral patterns, the system reduces the need for intensive real-time monitoring, thereby maintaining high behavioral analysis accuracy while reducing ongoing power consumption during actual execution state determination.
Solution Approach 2:
The system monitors a selective subset of behavioral parameters that are most indicative of execution state, rather than continuously monitoring all possible device activities. By focusing on the most relevant behavioral signals (partial action), the system achieves sufficient behavioral analysis accuracy without the excessive power consumption that would result from comprehensive continuous monitoring of all device operations.
Data Source
AI summary
Methods, systems and devices compute and use the actual execution states of software applications to implement power saving schemes and to perform behavioral monitoring and analysis operations. A mobile device may be configured to monitor an activity of a software application, generate a shadow feature value that identifies actual execution state of the software application during that activity, generate a behavior vector that associates the monitored activity with the shadow feature value, and determine whether the activity is malicious or benign based on the generated behavior vector, shadow feature value and/or operating system execution states. The mobile device processor may also be configured to intelligently determine whether the execution state of a software application is relevant to determining whether any of the monitored mobile device behaviors are malicious or suspicious, and monitor only the execution states of the software applications for which such determinations are relevant.