Methods and Systems of Dynamically Determining Feature Sets for the Efficient Classification of Mobile Device Behaviors

A computing device, comprising:

• a memory;
• and
• a processor coupled to the memory and configured with processor-executable instructions to perform operations comprising:
• monitoring activities of a software application executing on the processor by collecting behavior information and storing the collected behavior information in a log of actions stored in the memory;
• generating a behavior vector that includes a behavior feature that identifies an aspect of a monitored activity of the software application;
• applying the generated behavior vector to a classifier model to generate analysis results;
• using the analysis results to update a way the behavior feature is computed and regenerating the behavior feature using the updated way so that the regenerated behavior feature identifies a different aspect of the monitored activity;
• regenerating the behavior vector to include the regenerated behavior feature;
• and
• applying the regenerated behavior vector to the classifier model to determine whether the software application is non-benign.

A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a computing device processor to perform operations comprising:

• monitoring activities of a software application by collecting behavior information and storing the collected behavior information in a log of actions stored in memory;
• generating a behavior vector that includes a behavior feature that identifies an aspect of a monitored activity of the software application;
• applying the generated behavior vector to a classifier model to generate analysis results;
• using the analysis results to update a way the behavior feature is computed and regenerating the behavior feature using the updated way so that the regenerated behavior feature identifies a different aspect of the monitored activity;
• regenerating the behavior vector to include the regenerated behavior feature;
• and
• applying the regenerated behavior vector to the classifier model to determine whether the software application is non-benign.