Malware and anomaly detection via activity recognition based on sensor data

A method for providing malware and anomaly detection via activity recognition based on sensor data, the method comprising:

• analyzing sensor data collected during a selected time period from at least one sensor associated with a device;
• determining, by utilizing instructions from memory that are executed by a processor, a context of the device when the device is in a connected state, wherein the context of the device is determined based on the sensor data collected during the selected time period, wherein the context of the device comprises an indication as to a physical orientation of the device and a position of the device;
• determining if traffic received or transmitted by the device during the connected state is in a white list;
• and
• transmitting an alert if the traffic is not in the white list and if the context determined for the device indicates that the context does not correlate with the traffic.

A computer-readable device comprising instructions, which when executed by a processor, cause the processor to perform operations comprising:

• analyzing sensor data collected during a selected time period from at least one sensor associated with a device;
• determining a context of the device when the device is in a connected state, wherein the context of the device is determined based on the sensor data collected during the selected time period, wherein the context of the device comprises an indication as to a physical orientation of the device and a position of the device;
• determining if traffic received or transmitted by the device during the connected state is in a white list;
• and
• transmitting an alert if the traffic is not in the white list and if the context determined for the device indicates that the context does not correlate with the traffic.