Abstract: Methods, devices, systems, and non-transitory process-readable storage media for a computing device to use machine learning to dynamically configure an application and/or complex algorithms associated with the application. An aspect method performed by a processor of the computing device may include operations for performing an application that calls a library function associated with a complex algorithm, obtaining signals indicating user responses to performance of the application, determining whether a user tolerates the performance of the application based on the obtained signals indicating the user responses, adjusting a configuration of the application to improve a subsequent performance of the application in response to determining the user does not tolerate the performance of the application, and storing data indicating the user responses to the performance of the application and other external variables for use in subsequent evaluations of user inputs.

Abstract: Systems, methods, and devices of the various aspects enable identification of anomalous application behavior. A computing device processor may detect network communication activity of an application on the computing device. The processor may identify one or more device states of the computing device, and one or more categories of the application. The processor may determine whether the application is behaving anomalously based on a correlation of the detected network communication activity of the application, the identified one or more device states of the computing device, and the identified one or more categories of the application.

Abstract: Various methods, apparatuses and/or articles of manufacture are provided which may be implemented for use by a mobile device to alter a scan operation. Various methods, apparatuses and/or articles of manufacture are provided which may be implemented for use by one or more electronic devices to determine one or more scan factors for use by a mobile device in altering a scan operation.

Abstract: Methods, apparatuses, systems, and computer-readable media for using haptic technologies to provide enhanced media experiences are presented. According to one or more aspects of the disclosure, a computing device, such as a smart phone, tablet computer, or portable media player, may establish a connection with a local content receiver. Subsequently, the computing device may receive, from the local content receiver, a sensation data signal that specifies one or more haptic effects to be provided at a particular time relative to playback of a media content item received by the local content receiver. Thereafter, the computing device may provide the one or more haptic effects.

Abstract: The disclosure generally relates to behavioral analysis to automate monitoring Internet of Things (IoT) device health in a direct and/or indirect manner. In particular, normal behavior associated with an IoT device in a local IoT network may be modeled such that behaviors observed at the IoT device may be compared to the modeled normal behavior to determine whether the behaviors observed at the IoT device are normal or anomalous. Accordingly, in a distributed IoT environment, more powerful “analyzer” devices can collect behaviors locally observed at other (e.g., simpler) “observer” devices and conduct behavioral analysis across the distributed IoT environment to detect anomalies potentially indicating malicious attacks, malfunctions, or other issues that require customer service and/or further attention.

Abstract: Various aspects include methods and computing devices implementing the methods for evaluating device behaviors in the computing devices. Aspect methods may include using a behavior-based machine learning technique to classify a device behavior as one of benign, suspicious, and non-benign. Aspect methods may include using one of a multi-label classification and a meta-classification technique to sub-classify the device behavior into one or more sub-categories. Aspect methods may include determining a relative importance of the device behavior based on the sub-classification, and determining whether to perform robust behavior-based operations based on the determined relative importance of the device behavior.

Abstract: Programmatic mechanisms that enable the automatic assignment of categories to network entities based on observed evidence. Agents gather observation data that identifies observations made by agents about the network and a plurality of nodes of the network. The agents provide the observation data to a classification module, which assigns a device category to the nodes of the network based on the observation data and a probabilistic node model. The probabilistic node model considers several probabilities to ascertain a recommended device category for a particular node, such as probabilities based on a manufacturer of a node, an operating system executing on a node, information about other nodes in the local vicinity of a node, and an administrator web page associated with a node. The classification module may also assign a particular network category to the network based on the observation data and a probabilistic network model.

Abstract: Approaches for modeling a risk of security breaches to a network. Agents gather, from multiple sources across the network, analysis data that identifies observed characteristics of habitable nodes and opaque nodes. Using the analysis data a multi-layer risk model for the network is generated that comprises a first layer that models an inherent risk of security breaches to assets of the network based on the observed characteristics. The model also comprises a second layer that models a present state of the inherent risk to the assets caused by global and temporal events. The model also comprises a third layer that models a change to the risk of security breaches in response to potential mitigative actions. The model may be used to understand how risk of a security breach is distributed and interdependent upon the nodes of the network so as to allow the most valuable preventive measures to be taken.

Abstract: A computing device processor may be configured with processor-executable instructions to implement methods of detecting and responding to fake user interaction (UI) events. The processor may determine whether a user interaction event is a fake user interaction event by analyzing raw data generated by one or more hardware drivers in conjunction with user interaction event information generated or received by the high-level operating system. In addition, the processor may be configured with processor-executable instructions to implement methods of using behavioral analysis and machine learning techniques to identify, prevent, correct, or otherwise respond to malicious or performance-degrading behaviors of the computing device based on whether a detected user interaction event is an authentic or fake user interaction event.

Abstract: Methods, apparatuses, systems, and computer-readable media for integrating sensation functionalities into a mobile device using a haptic sleeve are presented. According to one or more aspects of the disclosure, a computing device may receive, via a haptic sleeve, sensation input captured by one or more haptic components of the haptic sleeve. Subsequently, the computing device may store haptic data corresponding to the received sensation input. For example, in storing such haptic data, the computing device may store information describing one or more electrical signals received via the one or more haptic components of the haptic sleeve during a period of time corresponding to a particular event, and this stored information may reflect various characteristics of the sensation input received by the computing device in connection with the particular event, such as the magnitude(s), position(s), duration, and/or type(s) of sensation(s) captured during the period of time.

Abstract: A computing device may be configured to work in conjunction with another component (e.g., a server) to better determine whether a software application is benign or non-benign. This may be accomplished via the server performing static and/or dynamic analysis operations, generating a behavior information structure that describes or characterizes the range of correct or expected behaviors of the software application, and sending the behavior information structure to a computing device. The computing device may compare the received behavior information structure to a locally generated behavior information structure to determining whether the observed behavior of the software application differs or deviates from the expected behavior of the software application or whether the observed behavior is within the range of expected behaviors. The computing device may increase its level of security/scrutiny when the behavior information structure does not match the local behavior information structure.

Abstract: Methods, apparatuses, systems, and computer-readable media for integrating sensation functionalities into a mobile device using a haptic sleeve are presented. According to one or more aspects of the disclosure, a computing device may receive, via a haptic sleeve, sensation input captured by one or more haptic components of the haptic sleeve. Subsequently, the computing device may store haptic data corresponding to the received sensation input. For example, in storing such haptic data, the computing device may store information describing one or more electrical signals received via the one or more haptic components of the haptic sleeve during a period of time corresponding to a particular event, and this stored information may reflect various characteristics of the sensation input received by the computing device in connection with the particular event, such as the magnitude(s), position(s), duration, and/or type(s) of sensation(s) captured during the period of time.

Abstract: Systems, apparatus and methods for estimating a location of a mobile device are presented. Before computing a location estimate, the mobile device groups a plurality of access points into two or more categories (for example, a first list of access points having a first characteristic and a second list of access points having a second characteristic). Round-trip time (RTT) measurements are computed for access points in the first list. A Short Interframe Space (SIFS) value may be determined for each access point in the first list or generally SIFT representing the first list as a whole. The RTT measurements are compensated with the appropriate SIFS value. The mobile device then computes its location or position fix estimate using the compensated RTT values while excluding less accurate RTT values from other access points. As a result, the location estimate eliminates adverse influent from some access points.

Abstract: Systems and methods for recognizing and reacting to malicious or performance-degrading behaviors in a mobile device include observing mobile device behaviors in an observer module within a privileged-normal portion of a secure operating environment to identify a suspicious mobile device behavior. The observer module may generate a concise behavior vector based on the observations, and provide the vector to an analyzer module in an unprivileged-secure portion of the secure operating environment. The vector may be analyzed in the unprivileged-secure portion to determine whether the mobile device behavior is benign, suspicious, malicious, or performance-degrading. If the behavior is found to be suspicious, operations of the observer module may be adjusted, such as to perform deeper observations. If the behavior is found to be malicious or performance-degrading behavior the user and/or a client module may be alerted in a secure, tamper-proof manner.

Abstract: In one implementation, a method may comprise: storing a user profile indicative of at least one attribute of a user of a mobile station; determining a measurement value based, at least in part, on a signal from at least one sensor on the mobile station; and estimating a location of the mobile station based, at least in part, on an association of the at least one attribute and the measurement value with a context parameter map database.

Abstract: Systems, apparatus and methods for determining a cyclic shift diversity (CSD) mode are presented. Examples communicate the CSD mode in a signaling message. Specifically, a CSD mode is set in an access point the sent to a mobile device. The signaling messages may be either a point-to-point message or a broadcast message. The access point or location server may set the current CSD mode from a plurality of mobile devices by crowd sourcing. For example, the plurality of mobile devices may report what CSD mode was detected. Alternative, the plurality of mobile devices may send a channel impulse response (CIR), or the like, to a location server and the location server may determine what CSD mode is currently used by the access point.

Abstract: Various aspects provide methods implemented by at least one processor executing on a mobile communication device to efficiently identify, classify, model, prevent, and/or correct the non-benign (e.g., performance degrading) conditions and/or behaviors that are related to an application operating on the device. Specifically, in various aspects, the mobile computing device may derive or extract application-specific features by performing a binary analysis of an application and may determine the application's category (e.g., a “games,” “entertainment,” or “news” category) based on the application-specific features. The mobile computing device may also obtain a classifier model associated with the application's category that includes various conditions, features, behaviors and corrective actions that may be used to quickly identify and correct non-benign behaviors (e.g., undesirable, malicious, and/or performance-degrading behaviors) occurring on the mobile computing device that are related to the application.

Abstract: A computing device processor may be configured with processor-executable instructions to implement methods of using behavioral analysis and machine learning techniques to identify, prevent, correct, or otherwise respond to malicious or performance-degrading behaviors of the computing device. As part of these operations, the processor may generate user-persona information that characterizes the user based on that user's activities, preferences, age, occupation, habits, moods, emotional states, personality, device usage patterns, etc. The processor may use the user-persona information to dynamically determine the number of device features that are monitored or evaluated in the computing device, to identify the device features that are most relevant to determining whether the device behavior is not consistent with a pattern of ordinary usage of the computing device by the user, and to better identify or respond to non-benign behaviors of the computing device.

Abstract: Methods, systems and devices for communicating behavior analysis information using an application programming interface (API) may include receiving data/behavior models from one or more third-party network servers in a client module of a mobile device and communicating the information to a behavior observation and analysis system via a behavior API. The third-party servers may be maintained by one or more partner companies that have domain expertise in a particular area or technology that is relevant for identifying, analyzing, classifying, and/or reacting to mobile device behaviors, but that do not have access to (or knowledge of) the various mobile device sub-systems, interfaces, configurations, modules, processes, drivers, and/or hardware systems required to generate effective data/behavior models suitable for use by the mobile device. The behavior API and/or client modules allow the third-party server to quickly and efficiently access the most relevant and important information on the mobile device.

Abstract: Methods, systems and devices compute and use the actual execution states of software applications to implement power saving schemes and to perform behavioral monitoring and analysis operations. A mobile device may be configured to monitor an activity of a software application, generate a shadow feature value that identifies actual execution state of the software application during that activity, generate a behavior vector that associates the monitored activity with the shadow feature value, and determine whether the activity is malicious or benign based on the generated behavior vector, shadow feature value and/or operating system execution states. The mobile device processor may also be configured to intelligently determine whether the execution state of a software application is relevant to determining whether any of the monitored mobile device behaviors are malicious or suspicious, and monitor only the execution states of the software applications for which such determinations are relevant.