Methods and Systems for Aggregated Multi-Application Behavioral Analysis of Mobile Device Behaviors

A computing device, comprising:

• a processor configured to:
• monitor activities of a plurality of software applications;
• collect behavior information for monitored activities of each of the plurality of software applications;
• generate a behavior vector based on the collected behavior information;
• apply the generated behavior vector to a classifier model to generate analysis information;
• and
• use the analysis information to evaluate a collective behavior of the plurality of software applications.

A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor to perform operations comprising:

• monitoring activities of a plurality of software applications;
• collecting behavior information for monitored activities of each of the plurality of software applications;
• generating a behavior vector based on the collected behavior information;
• applying the generated behavior vector to a classifier model to generate analysis information;
• and
• using the analysis information to evaluate a collective behavior of the plurality of software applications.

A computing device, comprising:

• means for monitoring activities of a plurality of software applications;
• means for collecting behavior information for monitored activities of each of the plurality of software applications;
• means for generating a behavior vector based on the collected behavior information;
• means for applying the generated behavior vector to a classifier model to generate analysis information;
• and
• means for using the analysis information to evaluate a collective behavior of the plurality of software applications.