Devices and Methods for Classifying an Execution Session

A mobile computing device, comprising:

• a memory;
• and
• a processor coupled to the memory and configured with processor-executable instructions to perform operations comprising:
• monitoring system activities and user activities of a software application or process to collect behavior information;
• correlating the system activities and the user activities;
• determining probabilities of the user activities and the system activities based, at least in part, on the behavior information;
• and
• generating an execution session context vector based, at least in part, on the correlated system activities and user activities, and the determined probabilities.

A mobile computing device, comprising:

• means for monitoring system activities and user activities of the software application or process to collect behavior information;
• means for correlating the system activities and the user activities;
• means for determining probabilities of the user activities and the system activities based, at least in part, on the behavior information;
• and
• means for generating an execution session context vector based, at least in part, on the correlated system activities and user activities, and the determined probabilities.

A non-transitory processor-readable medium having stored thereon processor-executable instructions configured to cause a processor to perform operations comprising:

• monitoring system activities and user activities of a software application or process to collect behavior information;
• correlating system activities and user activities;
• determining probabilities of the user activities and the system activities based, at least in part, on the behavior information;
• and
• generating an execution session context vector based, at least in part, on the correlated system activities and user activities, and the determined probabilities.