# US 9,519,775 B2 · Pre-identifying probable malicious behavior based on configuration pathways > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,519,775 B2 - Document ID: US9519775B2 - Status: Granted - Kind: B2 - Application number: 14/044,937 - Filed: 2013-10-03 - Published: 2015-04-09 - Granted: 2016-12-13 - Earliest claimed: 2013-10-03 - Assignees: QUALCOMM Incorporated - Applicants: QUALCOMM Incorporated - Inventors: Vinay Sridhara; Salyajit Prabhakar Patne; Rajarshi Gupta - Web page: https://patentgrep.com/patent/US9519775B2 ## CPC - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1433: {Vulnerability analysis} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04W 12/12: Detection or prevention of fraud - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - G06F 9/44505: {Configuring for program initiating, e.g. using registry, configuration files} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The various aspects include systems and methods for enabling mobile computing devices to recognize when they are at risk of experiencing malicious behavior in the near future given a current configuration. Thus, the various aspects enable mobile computing devices to anticipate malicious behaviors before a malicious behavior begins rather than after the malicious behavior has begun. In the various aspects, a network server may receive behavior vector information from multiple mobile computing devices and apply pattern recognition techniques to the received behavior vector information to identify malicious configurations and pathway configurations that may lead to identified malicious configurations. The network server may inform mobile computing devices of identified malicious configurations and the corresponding pathway configurations, thereby enabling mobile computing devices to anticipate and prevent malicious behavior from beginning by recognizing when they have entered a pathway configuration leading to malicious behavior. ## Claims ### Claim 1 A method of predicting probable malicious behavior on a mobile computing device, comprising: receiving, via a processor of the mobile computing device, a pathway configuration database from a server computing device, wherein the received pathway configuration database includes information identifying: a configuration pattern; a pathway between configurations that lead to a non-benign configuration; and a probability value that identifies the possibility that the pathway will lead to a non-benign behavior; determining, via the processor, operations scheduled for execution on the mobile computing device; determining, via the processor, a probability that execution of scheduled operations will result in the non-benign behavior in the mobile computing device based on the information included in the received pathway configuration database; and implementing preventative measures in response to determining that the probability that the execution of scheduled operations will result in the non-benign behavior exceeds a threshold value. ### Claim 2 (depends on 1) The method of claim 1, wherein implementing the preventative measures comprises: identifying a process associated with the operations scheduled for execution on the mobile computing device; and slowing down execution of the process. ### Claim 3 (depends on 2) The method of claim 2, further comprising: examining other behaviors occurring on the mobile computing device; determining a current configuration of the mobile computing device; determining whether there is a substantial likelihood that the current configuration will result in the non-benign behavior based on examining the other behaviors; and implementing the preventative measures for the process in response to determining that there is a substantial likelihood that the current configuration will result in the non-benign behavior based on examining the other behaviors. ### Claim 4 (depends on 2) The method of claim 2, further comprising: determining a classification of a current configuration of the mobile computing device; determining a classification of a potential future configuration of the mobile computing device; determining a likelihood of the current configuration causing the non-benign behavior based on the classification of the current configuration and the classification of the potential future configuration; determining whether the likelihood is substantial; and implementing the preventative measures for the process in response to determining that the likelihood is substantial. ### Claim 5 (depends on 2) The method of claim 2, further comprising: determining a current configuration of the mobile computing device; determining a probability of the current configuration causing the non-benign behavior based on the current configuration and the probability value included in the received pathway configuration database; determining whether the probability of the current configuration leading to the non-benign behavior exceeds a risk threshold; and implementing the preventative measures for the process in response to determining that the probability of the current configuration causing the non-benign behavior exceeds the risk threshold. ### Claim 6 A mobile computing device, comprising: a memory; a transceiver; and a processor coupled to the memory and the transceiver, wherein the processor is configured with processor-executable instructions to perform operations comprising: receiving a pathway configuration database from a server computing device, wherein the received pathway configuration database includes information identifying: a configuration pattern, a pathway between configurations that lead to a non-benign configuration, and a probability value that identifies the possibility that the pathway will lead to a non-benign behavior; determining operations scheduled for execution on the mobile computing device; determining a probability that execution of scheduled operations will result in the non-benign behavior in the mobile computing device based on the information included in the received pathway configuration database; and implementing preventative measures in response to determining that the probability that the execution of scheduled operations will result in the non-benign behavior exceeds a threshold value. ### Claim 7 (depends on 6) The mobile computing device of claim 6, wherein the processor is configured with processor-executable instructions to perform operations such that implementing the preventative measures comprises: identifying a process associated with the operations scheduled for execution on the mobile computing device; and slowing down execution of the process. ### Claim 8 (depends on 7) The mobile computing device of claim 7, wherein the processor is configured with processor-executable instructions to perform operations further comprising: examining other behaviors occurring on the mobile computing device; determining a current configuration of the mobile computing device; determining whether there is a substantial likelihood that the current configuration will result in the non-benign behavior based on examining the other behaviors; and implementing the preventative measures for the process in response to determining that there is a substantial likelihood that the current configuration will result in the non-benign behavior based on examining the other behaviors. ### Claim 9 (depends on 7) The mobile computing device of claim 7, wherein the processor is configured with processor-executable instructions to perform operations further comprising: determining a classification of a current configuration of the mobile computing device; determining a classification of a potential future configuration of the mobile computing device; determining a likelihood of the current configuration causing the non-benign behavior based on the classification of the current configuration and the classification of the potential future configuration; determining whether the likelihood is substantial; and implementing the preventative measures for the process in response to determining that the likelihood is substantial. ### Claim 10 (depends on 7) The mobile computing device of claim 7, wherein the processor is configured with processor-executable instructions to perform operations further comprising: determining a current configuration of the mobile computing device; determining a probability of the current configuration causing the non-benign behavior based on the current configuration and the probability value included in the received pathway configuration database; determining whether the probability of the execution of scheduled operations causing the non-benign behavior exceeds a risk threshold; and implementing the preventative measures for the process in response to determining that the probability of the current configuration causing the non-benign behavior exceeds the risk threshold. ### Claim 11 A mobile computing device, comprising: means for receiving a pathway configuration database from a server computing device, wherein the received pathway configuration database includes information identifying: a configuration pattern; a pathway between configurations that lead to a non-benign configuration; and a probability value that identifies the possibility that the pathway will lead to a non-benign behavior; means for determining operations scheduled for execution on the mobile computing device; means for determining a probability that execution of scheduled operations will result in the non-benign behavior in the mobile computing device based on the information included in the received pathway configuration database; and means for implementing preventative measures in response to determining that the probability that the execution of scheduled operations will result in the non-benign behavior exceeds a threshold value. ### Claim 12 (depends on 11) The mobile computing device of claim 11, wherein means for implementing preventative measures comprises: means for identifying a process associated with a current configuration; and means for slowing down execution of the process. ### Claim 13 (depends on 12) The mobile computing device of claim 12, further comprising: means for examining other behaviors occurring on the mobile computing device; means for determining whether there is a substantial likelihood that the current configuration will result in the non-benign behavior based on examination of the other behaviors; and means for implementing preventative measures for the process in response to determining that there is a substantial likelihood that the current configuration will result in the non-benign behavior based on examining the other behaviors. ### Claim 14 (depends on 12) The mobile computing device of claim 12, further comprising: means for determining a classification of the current configuration; means for determining a classification of a potential future configuration; means for determining a likelihood of the current configuration causing the non-benign behavior based on the classification of the current configuration and the classification of the potential future configuration; means for determining whether the likelihood is substantial; and means for implementing preventative measures for the process in response to determining that the likelihood is substantial. ### Claim 15 (depends on 12) The mobile computing device of claim 12, further comprising: means for determining a probability of the current configuration leading to a malicious configuration based on the current configuration and the probability value included in the received pathway configuration database; means for determining whether the probability of the current configuration leading to the malicious configuration exceeds a risk threshold; and means for implementing preventative measures for the process in response to determining that the probability of the current configuration leading to the malicious configuration exceeds the risk threshold. ### Claim 16 A non-transitory processor-readable storage medium having stored thereon processor-executable instructions configured to cause a mobile computing device processor of a mobile computing device to perform operations comprising: receiving a pathway configuration database from a server computing device, wherein the received pathway configuration database includes information identifying: a configuration pattern; a pathway between configurations that lead to a non-benign configuration; and a probability value that identifies the possibility that the pathway will lead to a non-benign behavior; determining a probability that execution of scheduled operations will result in the non-benign behavior in the mobile computing device based on the information included in the received pathway configuration database; and implementing preventative measures in response to determining that the probability that the execution of scheduled operations will result in the non-benign behavior exceeds a threshold value. ### Claim 17 (depends on 16) The non-transitory processor-readable storage medium of claim 16, wherein the stored processor-executable instructions are configured to cause a mobile computing device processor to perform operations such that implementing the preventative measures comprises: identifying a process associated with the operations scheduled for execution on the mobile computing device; and slowing down execution of the process. ### Claim 18 (depends on 17) The non-transitory processor-readable storage medium of claim 17, wherein the stored processor-executable instructions are configured to cause a mobile computing device processor to perform operations further comprising: examining other behaviors occurring on the mobile computing device; determining a current configuration of the mobile computing device; determining whether there is a substantial likelihood that the current configuration will result in the non-benign behavior based on examining the other behaviors; and implementing the preventative measures for the process in response to determining that there is a substantial likelihood that the current configuration will result in the non-benign behavior based on examining the other behaviors. ### Claim 19 (depends on 17) The non-transitory processor-readable storage medium of claim 17, wherein the stored processor-executable instructions are configured to cause a mobile computing device processor to perform operations further comprising: determining a classification of a current configuration of the mobile computing device; determining a classification of a potential future configuration of the mobile computing device; determining a likelihood of the current configuration causing the non-benign behavior based on the classification of the current configuration and the classification of the potential future configuration; determining whether the likelihood is substantial; and implementing the preventative measures for the process in response to determining that the likelihood is substantial. ### Claim 20 (depends on 17) The non-transitory processor-readable storage medium of claim 17, wherein the stored processor-executable instructions are configured to cause a mobile computing device processor to perform operations further comprising: determining a current configuration of the mobile computing device; determining a probability of the current configuration causing the non-benign behavior based on the current configuration and the probability value included in the received pathway configuration database; determining whether the probability of the current configuration causing the non-benign behavior exceeds a risk threshold; and implementing the preventative measures for the process in response to determining that the probability of the current configuration causing the non-benign behavior exceeds the risk threshold.