# US 2016/0366126 A1 · Screen-analysis based device security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366126 A1 - Document ID: US20160366126A1 - Status: Published application - Kind: A1 - Application number: 14/739,107 - Filed: 2015-06-15 - Published: 2016-12-15 - Earliest claimed: 2015-06-15 - Assignees: Google Inc. - Applicants: Google Inc. - Inventors: Matthew SHARIFI; Kai WANG; David PETROU - Web page: https://patentgrep.com/patent/US20160366126A1 ## CPC - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04W 4/02: Services making use of location information - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - G06F 21/36: by graphic or iconic representation - G06N 20/00: Machine learning - H04W 4/029: Location-based management or tracking services - H04W 12/06: Authentication - H04W 12/126: Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning - H04W 12/30: Security of mobile devices; Security of mobile applications - H04L 63/102: {Entity profiles} - H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication - H04W 12/10: Integrity - H04W 12/63: Location-dependent; Proximity-dependent - H04W 12/68: Gesture-dependent or behaviour-dependent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Systems and methods are provided for a content-based security for computing devices. An example method includes identifying content rendered by a mobile application, the content being rendered during a session, generating feature vectors from the content and determining that the feature vectors do not match a classification model. The method also includes providing, in response to the determination that the feature vectors do not match the classification model, a challenge configured to authenticate a user of the mobile device. Another example method includes determining a computing device is located at a trusted location, capturing information from a session, the information coming from content rendered by a mobile application during the session, generating feature vectors for the session, and repeating this until a training criteria is met. The method also includes training a classification model using the feature vectors and authenticating a user of the device using the trained classification model. ## Claims ### Claim 1 A mobile device comprising: at least one processor; and memory storing instructions that, when executed by the at least one processor, cause the mobile device to: identify content rendered by a mobile application, the content being rendered during a session, generate feature vectors from the content, determine that the feature vectors do not match a classification model, and provide, in response to the determination that the feature vectors do not match the classification model, a challenge configured to authenticate a user of the mobile device. ### Claim 2 (depends on 1) The mobile device of claim 1, the session being a first session and the challenge being based on a previous session distinct from the first session, the previous session including feature vectors that matched the classification model. ### Claim 3 (depends on 1) The mobile device of claim 1, the session being a first session and the challenge being based on a previous session distinct from the first session, the previous session including feature vectors verified using a trusted location. ### Claim 4 (depends on 1) The mobile device of claim 1, the session being a first session and the challenge being based on a previous session distinct from the first session, the previous session including feature vectors verified by a previous challenge. ### Claim 5 (depends on 1) The mobile device of claim 1, wherein the challenge is configured to prompt the user to complete information missing from a screen displayed by the mobile device in a previous session that included feature vectors that matched the classification model. ### Claim 6 (depends on 1) The mobile device of claim 1, wherein providing the challenge includes: extracting information from a screen displayed by the mobile device in a previous session that included feature vectors matching the classification model; and generating a multiple choice question based on the extracted information. ### Claim 7 (depends on 1) The mobile device of claim 1, wherein the memory further stores instructions that, when executed by the at least one processor, cause the mobile device to: receive a response to the challenge; and lock the mobile device when the response fails the challenge. ### Claim 8 (depends on 1) The mobile device of claim 1, wherein the challenge includes a series of sub-challenges. ### Claim 9 A method comprising: determining that a mobile device is located at a trusted location; capturing information from a session, the information coming from content rendered by a mobile application running on the mobile device during the session; generating feature vectors for the session; repeating the capturing and determining until a training criteria is met; training a classification model using at least some of the feature vectors; and authenticating a user of the mobile device using the trained classification model. ### Claim 10 (depends on 9) The method of claim 9, wherein the training criteria includes a minimum quantity of sessions or a minimum classification accuracy. ### Claim 11 (depends on 9) The method of claim 9, wherein authenticating the user using the trained classification model includes: determining a current session based on content rendered by a mobile application; generating feature vectors for the session; and providing, in response to determining that the feature vectors do not match the classification model, a challenge configured to authenticate a user of the mobile device. ### Claim 12 (depends on 9) The method of claim 9, wherein determining the mobile device is located at a trusted location includes: accessing a user profile associated with the mobile device to determine a trusted location; and determining that the mobile device is currently located at the trusted location. ### Claim 13 (depends on 12) The method of claim 12, wherein the trusted location is represented by global positioning system (GPS) coordinates and the mobile device uses current GPS coordinates to determine whether the mobile device is current at the trusted location. ### Claim 14 (depends on 12) The method of claim 12, wherein the trusted location is represented by a wireless network identifier and the mobile device determines whether a wireless network the mobile device is connected to matches the wireless network identifier. ### Claim 15 A mobile device comprising: at least one processor; and memory storing instructions that, when executed by the at least one processor, cause the mobile device to: identify content rendered by a mobile application, the content being rendered during a session, generate feature vectors from the content, apply a classification model to the feature vectors, determine whether the feature vectors match a first user profile based on application of the classification model, the first user profile differing from a second user profile, the mobile device being currently associated with the second user profile, and initiate a profile switch responsive to determining that the feature vectors match the first user profile. ### Claim 16 (depends on 15) The mobile device of claim 15, wherein the memory further stores instructions that, when executed by the at least one processor, cause the mobile device to: determine that the feature vectors match no user profiles; and provide a challenge configured to authenticate a user of the mobile device. ### Claim 17 (depends on 16) The mobile device of claim 16, wherein the challenge is based on second content rendered during a previous session associated with the second user profile, the second content being associated with feature vectors consistent with the second user profile according to the classification model. ### Claim 18 (depends on 16) The mobile device of claim 16, wherein the challenge is based on second content rendered during a previous session associated with the first user profile when the classification model determines the first user profile has a higher confidence score than the second user profile with regard to the feature vectors. ### Claim 19 (depends on 15) The mobile device of claim 15, wherein the memory further stores instructions that, when executed by the at least one processor, cause the mobile device to train the classification model by: determining that a mobile device is located in a trusted environment associated with the second user profile; recognizing content rendered by a mobile application running on the mobile device, the content being associated with a session; generating feature vectors for the content; repeating the recognizing and generating for at least a minimum quantity of sessions; and training the classification model using the feature vectors as positive examples, the positive examples being associated with the second user profile. ### Claim 20 (depends on 19) The mobile device of claim 19, wherein positive examples associated with the first user profile are used as negative examples for the second user profile in training the classification model.