# US 9,439,077 B2 · Method for malicious activity detection in a mobile station > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,439,077 B2 - Document ID: US9439077B2 - Status: Granted - Kind: B2 - Application number: 13/741,388 - Filed: 2013-01-15 - Published: 2013-10-10 - Granted: 2016-09-06 - Earliest claimed: 2012-04-10 - Assignees: QUALCOMM Incorporated - Applicants: QUALCOMM Incorporated - Inventors: Rajarshi Gupta; Saumitra Mohan Das - Web page: https://patentgrep.com/patent/US9439077B2 ## CPC - H04W 12/12: Detection or prevention of fraud - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/552: {involving long-term monitoring or reporting} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed is a method for malicious activity detection in a mobile station of a particular model. In the method, generic malicious behavior patterns are received from a network-based malicious behavior profiling system. Mobile-station-model-specific-behavior-analysis algorithms are generated in the mobile station based on the generic malicious behavior patterns. Mobile station operations may be observed to generate a mobile station activity observation. The mobile station activity observation may be analyzed using the mobile-station-model-specific-behavior-analysis algorithms to generate an activity analysis. Malicious activity may be detected based on the activity analysis. ## Claims ### Claim 1 A method of analyzing a behavior of an application operating in a mobile station, comprising: receiving, in a processor of the mobile station, mobile-station-model-agnostic behavior pattern information from a server; using, by the processor, the received mobile-station-model-agnostic behavior pattern information to generate a mobile-station-model-specific behavior model in the mobile station; monitoring, by the processor, one or more mobile station operations to collect behavior information in the mobile station; analyzing, by the processor, the behavior of the application operating on the mobile station by applying the collected behavior information to the generated mobile-station-model-specific behavior model; classifying, by the processor, the behavior of the application operating on the mobile station as not benign based on a result of applying the collected behavior information to the mobile-station-model-specific behavior model; and removing the application associated with the behavior classified as not benign. ### Claim 2 (depends on 1) The method of claim 1, wherein receiving mobile-station-model-agnostic behavior pattern information from the server comprises receiving information that is not specific to a particular model of the mobile station. ### Claim 3 (depends on 1) The method of claim 1, wherein monitoring one or more mobile station operations to collect behavior information in the mobile station comprises monitoring an activity of a Webkit of the mobile station. ### Claim 4 (depends on 1) The method of claim 1, wherein monitoring one or more mobile station operations to collect behavior information in the mobile station comprises monitoring an activity of a high-level operating system (HLOS) of the mobile station. ### Claim 5 (depends on 1) The method of claim 1, wherein monitoring one or more mobile station operations to collect behavior information in the mobile station comprises monitoring an activity of a kernel of the mobile station. ### Claim 6 (depends on 1) The method of claim 1, wherein monitoring one or more mobile station operations to collect behavior information in the mobile station comprises monitoring an activity of a driver of the mobile station. ### Claim 7 (depends on 1) The method of claim 1, wherein monitoring one or more mobile station operations to collect behavior information in the mobile station comprises monitoring an activity of a hardware component of the mobile station. ### Claim 8 A mobile station, comprising: means for receiving mobile-station-model-agnostic behavior pattern information from a server; means for using the received mobile-station-model-agnostic behavior pattern information received from the server to generate a mobile-station-model-specific behavior model in the mobile station; means for monitoring one or more mobile station operations to collect behavior information in the mobile station; means for analyzing a behavior of an application operating on the mobile station by applying the collected behavior information to the generated mobile-station-model-specific behavior model; means for classifying the behavior of the application operating on the mobile station as not benign based on a result of applying the collected behavior information to the mobile-station-model-specific behavior model; and means for removing the application associated with the behavior classified as not benign. ### Claim 9 (depends on 8) The mobile station of claim 8, wherein means for receiving mobile-station-model-agnostic behavior pattern information from the server comprises means for receiving information that is not specific to a particular model of the mobile station. ### Claim 10 A mobile station, comprising: a processor configured with processor-executable instructions to perform operations comprising: receiving mobile-station-model-agnostic behavior pattern information from a server; using the received mobile-station-model-agnostic behavior pattern information to generate a mobile-station-model-specific behavior model in the mobile station; monitoring one or more mobile station operations to collect behavior information in the mobile station; analyzing a behavior of an application operating on the mobile station by applying the collected behavior information to the generated mobile-station-model-specific behavior model; classifying the behavior of the application operating on the mobile station as not benign based on a result of applying the collected behavior information to the mobile-station-model-specific behavior model; and removing the application associated with the behavior classified as not benign. ### Claim 11 (depends on 10) The mobile station of claim 10, wherein the processor is configured with processor-executable instructions to perform operations such that receiving mobile-station-model-agnostic behavior pattern information from the server comprises receiving information that is not specific to a particular model of the mobile station. ### Claim 12 A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor in a mobile station to perform operations comprising: receiving mobile-station-model-agnostic behavior pattern information from a server; using the received mobile-station-model-agnostic behavior pattern information received from the server to generate a mobile-station-model-specific behavior model in the mobile station; monitoring one or more mobile station operations to collect behavior information in the mobile station; analyzing a behavior of an application operating on the mobile station by applying the collected behavior information to the generated mobile-station-model-specific behavior model; classifying the behavior of the application operating on the mobile station as not benign based on a result of applying the collected behavior information to the mobile-station-model-specific behavior model; and removing the application associated with the behavior classified as not benign. ### Claim 13 (depends on 12) The non-transitory computer readable storage medium of claim 12, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that receiving mobile-station-model-agnostic behavior pattern information from the server comprises receiving information that is not specific to a particular model of the mobile station.