Method for malicious activity detection in a mobile station

A mobile station, comprising:

• means for receiving mobile-station-model-agnostic behavior pattern information from a server;
• means for using the received mobile-station-model-agnostic behavior pattern information received from the server to generate a mobile-station-model-specific behavior model in the mobile station;
• means for monitoring one or more mobile station operations to collect behavior information in the mobile station;
• means for analyzing a behavior of an application operating on the mobile station by applying the collected behavior information to the generated mobile-station-model-specific behavior model;
• means for classifying the behavior of the application operating on the mobile station as not benign based on a result of applying the collected behavior information to the mobile-station-model-specific behavior model;
• and
• means for removing the application associated with the behavior classified as not benign.

A mobile station, comprising:

• a processor configured with processor-executable instructions to perform operations comprising:
• receiving mobile-station-model-agnostic behavior pattern information from a server;
• using the received mobile-station-model-agnostic behavior pattern information to generate a mobile-station-model-specific behavior model in the mobile station;
• monitoring one or more mobile station operations to collect behavior information in the mobile station;
• analyzing a behavior of an application operating on the mobile station by applying the collected behavior information to the generated mobile-station-model-specific behavior model;
• classifying the behavior of the application operating on the mobile station as not benign based on a result of applying the collected behavior information to the mobile-station-model-specific behavior model;
• and
• removing the application associated with the behavior classified as not benign.

A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor in a mobile station to perform operations comprising:

• receiving mobile-station-model-agnostic behavior pattern information from a server;
• using the received mobile-station-model-agnostic behavior pattern information received from the server to generate a mobile-station-model-specific behavior model in the mobile station;
• monitoring one or more mobile station operations to collect behavior information in the mobile station;
• analyzing a behavior of an application operating on the mobile station by applying the collected behavior information to the generated mobile-station-model-specific behavior model;
• classifying the behavior of the application operating on the mobile station as not benign based on a result of applying the collected behavior information to the mobile-station-model-specific behavior model;
• and
• removing the application associated with the behavior classified as not benign.