Methods and systems for analyzing data after initial analyses by known good and known bad security components
AssigneeLookout, Inc.
InventorKevin Patrick Mahaffey
Life of this patent
Estimating the term…
Abstract
Methods and systems are provided for conditionally allowing a mobile communications device to process received data. Initially, the data is analyzed by a known good component without the component determining that the data is safe, and the data is analyzed by a known bad component without the component determining that the data is malicious. Subsequently, the data is analyzed by a decision component on the mobile communications device. When the decision component determines the data to be safe, the decision component allows the mobile communications device to process the data. When the decision component determined the data to be malicious, the decision component prevents the mobile communications device from processing the data.
Claims15
A method comprising:
- receiving, by a decision component executing on a mobile communications device (MCD), data from a known bad component executing on the MCD, the data including first information regarding a set of requests and second information regarding a set of user responses to the set of requests, after:
- the data was analyzed, by a known good component executing on the MCD, in an attempt to determine whether the data is safe, the determination being that the known good component does not consider the data to be safe;
- and
- the data was analyzed, by the known bad component executing on the MCD, in an attempt to determine whether the data is malicious, the determination being that the known bad component does not consider the data to be malicious;
- analyzing, by the decision component, the data to determine whether the data is safe or malicious by analyzing the first information and the second information for a temporal component indicative of malicious behavior, the data being determined to be safe when the analysis of the data does not find a temporal component indicative of malicious behavior and the data being determined to be malicious when the analysis of the data finds a temporal component indicative of malicious behavior;
- and
- when the decision component determines that the data is safe, allowing the data to be further processed by the MCD;
- or
- when the decision component determines that the data is malicious, preventing the data from being further processed by the MCD.
A non-transitory, computer-readable storage medium having stored thereon a plurality of instructions, which, when executed by a processor of a mobile communications device (MCD), cause the MCD to:
- receive, by a decision component executing on the MCD, data from a known bad component executing on the MCD, the data including first information regarding a set of requests and second information regarding a set of user responses to the set of requests, after:
- the data was analyzed, by a known good component executing on the MCD, in an attempt to determine whether the data is safe, the determination being that the known good component does not consider the data to be safe;
- and
- the data was analyzed, by the known bad component executing on the MCD, in an attempt to determine whether the data is malicious, the determination being that the known bad component does not consider the data to be malicious;
- analyze, by the decision component, the data to determine whether the data is safe or malicious by analyzing the first information and the second information for a temporal component indicative of malicious behavior, the data being determined to be safe when the analysis of the data does not find a temporal component indicative of malicious behavior and the data being determined to be malicious when the analysis of the data finds a temporal component indicative of malicious behavior;
- and
- allow the data to be further processed when the decision component determines that the data is safe;
- or
- prevent the data from being further processed when the decision component determines that the data is malicious.
A system, comprising a mobile communications device (MCD) with at least one processor and memory and instructions that when executed by the at least one processor cause the MCD to:
- receive, by a decision component executing on the MCD, data from a known bad component executing on the MCD, the data including first information regarding a set of requests and second information regarding a set of user responses to the set of requests, after:
- the data was analyzed, by a known good component executing on the MCD, in an attempt to determine whether the data is safe, the determination being that the known good component does not consider the data to be safe;
- and
- the data was analyzed, by the known bad component executing on the MCD, in an attempt to determine whether the data is malicious, the determination being that the known bad component does not consider the data to be malicious;
- analyze, by the decision component, the data to determine whether the data is safe or malicious by analyzing the first information and the second information for a temporal component indicative of malicious behavior, the data being determined to be safe when the analysis of the data does not find a temporal component indicative of malicious behavior and the data being determined to be malicious when the analysis of the data finds a temporal component indicative of malicious behavior;
- and
- allow the data to be further processed when the decision component determines that the data is safe;
- or
- prevent the data from being further processed when the decision component determines that the data is malicious.
Dependencies are inferred from the claim text.