Abstract: Methods and systems for classifying mobile device behavior include configuring a server use a large corpus of mobile device behaviors to generate a full classifier model that includes a finite state machine suitable for conversion into boosted decision stumps and/or which describes all or many of the features relevant to determining whether a mobile device behavior is benign or contributing to the mobile device's degradation over time. A mobile device may receive the full classifier model and use the model to generate a full set of boosted decision stumps from which a more focused or lean classifier model is generated by culling the full set to a subset suitable for efficiently determining whether mobile device behavior are benign. Boosted decision stumps may be culled by selecting all boosted decision stumps that depend upon a limited set of test conditions.

Abstract: The various aspects provide a mobile device and methods implemented on the mobile device for modifying behavior models to account for device-specific or device-state-specific features. In the various aspects, a behavior analyzer module may leverage a full feature set of behavior models (i.e. a large classifier model) received from a network server to create lean classifier models for use in monitoring for malicious behavior on the mobile device, and the behavior analyzer module may dynamically modify these lean classifier models to include features specific to the mobile device and/or the mobile device's current configuration. Thus, the various aspects may enhance overall security for a particular mobile device by taking the mobile device and its current configuration into account and may improve overall performance by monitoring only features that are relevant to the mobile device.

Abstract: Methods, and mobile devices implementing the methods, use application-specific and/or application-type specific classifier to improve the efficiency and performance of a comprehensive behavioral monitoring and analysis system predicting whether a software application is causing undesirable or performance depredating behavior. The application-specific and application-type specific classifier models may include a reduced and more focused subset of the decision nodes that are included in a full or more complete classifier model that may be received or generated in the mobile device. The locally generated application-specific and/or application-type specific classifier models may be used to perform real-time behavior monitoring and analysis operations by applying the application-based classifier models to a behavior/feature vector generated by monitoring mobile device behavior.

Abstract: Apparatus and methods are directed to calibrating a delay within a wireless access point for determining a position of a mobile station. One method includes receiving an initial packet at an eavesdropping device, receiving a response packet, sent by another entity, at the eavesdropping device, computing a time difference based upon the packet arrival times, and providing the time difference to a position determination entity. Another method includes providing a request to appropriate eavesdropping devices to send information, receiving, from each appropriate eavesdropping device, a time difference which represents a difference in a time of arrival of a packet transmitted by the wireless access point and a time of arrival of a packet transmitted by the mobile station, determining a processing delay estimate based upon the time differences, and determining a position of the mobile station based upon the processing delay estimate and the received time differences.

Abstract: Methods, devices and systems for detecting suspicious or performance-degrading mobile device behaviors intelligently, dynamically, and/or adaptively determine computing device behaviors that are to be observed, the number of behaviors that are to be observed, and the level of detail or granularity at which the mobile device behaviors are to be observed. The various aspects efficiently identify suspicious or performance-degrading mobile device behaviors without requiring an excessive amount of processing, memory, or energy resources.

Abstract: A computing device processor may be configured with processor-executable instructions to implement methods of detecting and responding non-benign behaviors of the computing device. The processor may be configured to monitor device behaviors to collect behavior information, generate a behavior vector information structure based on the collected behavior information, apply the behavior vector information structure to a classifier model to generate analysis results, use the analysis results to classify a behavior of the device, use the analysis results to determine the features evaluated by the classifier model that contributed most to the classification of the behavior, and select the top “n” (e.g., 3) features that contributed most to the classification of the behavior. The computing device may display the selected features on an electronic display of the computing device.

Abstract: Methods, and computing devices implementing the methods, use application-based classifier models to improve the efficiency and performance of a comprehensive behavioral monitoring and analysis system predicting whether a software application is causing undesirable or performance depredating behavior. The application-based classifier models may include a reduced and more focused subset of the decision nodes that are included in a full or more complete classifier model that may be received or generated in the computing device. The application groups may be represented by application groups formed of computing device applications sharing related features, and may be generated using one or more clustering algorithms. Lean classifier models may be generated for each of the application group and may incorporate historical user input regarding execution permissions for features of applications within an application group.

Abstract: A position fix for a mobile platform is determined using RSSI values for wireless signals received from access points (APs), at least one of which has dynamic transmission power control. The transmission power data for the APs is received from an entity separate from the APs, e.g., a central entity or a positioning assistance server. The RSSI values for wireless signals received from the APs are acquired, as is an RSSI heatmap. Using the transmission power data, the RSSI values and the RSSI heatmap, the position fix for the mobile platform is determined. The position fix may be determined by the mobile platform or a positioning assistance server. Additionally, a server may receive transmission power data for APs and may provide to a mobile platform RSSI heatmap information based on the transmission power data. The RSSI heatmap information may be, e.g., the transmission power data or a RSSI heatmap.

Abstract: A computing device processor may be configured with processor-executable instructions to implement methods that include using expectation-maximization (EM) machine learning techniques to continuously, repeatedly, or recursively generate, train, improve, focus, or refine the machine learning classifier models that are used by a behavior-based monitoring and analysis system (or behavior-based security system) of the computing device to better identify and respond to various conditions or behaviors that may have a negative impact on its performance, power utilization levels, network usage levels, security and/or privacy over time.

Abstract: Described are devices, methods, techniques and systems for locating a portable services access transceiver (PSAT) for use in aiding emergency “911” services. In one implementation, one or more conditions indicative of movement of a PSAT may initiate a process for obtaining a new estimated location of the PSAT. In another implementation, a location of a PSAT may be determined or updated using indoor navigation techniques.

Abstract: Systems, methods, and devices of the various aspects enable identification of anomalous application behavior. A computing device processor may detect network communication activity of an application on the computing device. The processor may identify one or more device states of the computing device, and one or more categories of the application. The processor may determine whether the application is behaving anomalously based on a correlation of the detected network communication activity of the application, the identified one or more device states of the computing device, and the identified one or more categories of the application.

Abstract: An aspect computing device may be configured to perform program analysis operation in response to classifying a behavior as non-benign. The program analysis operation may identify new sequences of API calls or activity patterns that are associated with the identified non-benign behaviors. The computing device may learn new behavior features based on the program analysis operation or update existing behavior features based on the program analysis operation. For example, API sequences observed to occur when a non-benign behavior is recognized may be added to behavior features observed during program analysis operation.

Abstract: The various aspects include systems and methods for enabling mobile computing devices to recognize when they are at risk of experiencing malicious behavior in the near future given a current configuration. Thus, the various aspects enable mobile computing devices to anticipate malicious behaviors before a malicious behavior begins rather than after the malicious behavior has begun. In the various aspects, a network server may receive behavior vector information from multiple mobile computing devices and apply pattern recognition techniques to the received behavior vector information to identify malicious configurations and pathway configurations that may lead to identified malicious configurations.

Abstract: Methods and devices for tracking data flows in a computing device include monitoring memory in a hardware component of the computing device to identify a read operation that reads information from a tainted memory address, using heuristics to identify a first, second, and third number of operations performed after the identified read operation, marking memory addresses of write operations performed after first number of operations and before the second number of operations as tainted, and marking memory addresses of write operations performed after the third number of operations and before the second number of operations as untainted.

Abstract: Systems and methods of limiting wireless discovery range. A transmitting device may limit wireless discovery range by adjusting one or more transmission attributes of a discovery message, measuring inter-device distance based on range determination messages, or any combination thereof. A receiving device may limit wireless discovery range based on one or more attributes of a received discovery message, measuring inter-device distance based on range determination messages, or any combination thereof. Discovery messages may include a range adaptation bit indicating whether range adaptation is to be performed.

Abstract: Various embodiments include methods of evaluating device behaviors in a computing device and enabling white listing of particular behaviors. Various embodiments may include monitoring activities of a software application operating on the computing device, and generating a behavior vector information structure that characterizes a first monitored activity of the software application. The behavior vector information structure may be applied to a machine learning classifier model to generate analysis results. The analysis results may be used to classify the first monitored activity of the software application as one of benign, suspicious, and non-benign. A prompt may be displayed to the user that requests that the user select whether to whitelist the software application in response to classifying the first monitored activity of the software application as suspicious or non-benign. The first monitored activity may be added to a whitelist of device behaviors in response to receiving a user input.

Abstract: Methods, devices and systems for detecting suspicious or performance-degrading mobile device behaviors intelligently, dynamically, and/or adaptively determine computing device behaviors that are to be observed, the number of behaviors that are to be observed, and the level of detail or granularity at which the mobile device behaviors are to be observed. The various aspects efficiently identify suspicious or performance-degrading mobile device behaviors without requiring an excessive amount of processing, memory, or energy resources.

Abstract: Systems, apparatus and methods for determining a cyclic shift delay (CSD) mode from a plurality of CSD modes is disclosed. A received OFDM signal is converted to a channel impulse response (CIR) signal in the time domain and/or a channel frequency response (CFR) signal in the frequency domain. Matched filters and a comparator are used to determine a most likely current CSD mode. Alternatively, a classifier is used with a number of inputs including outputs from two or more matched filters and one or more outputs from a feature extractor. The feature extractor extracts features in the time domain from the CIR signal and/or in the frequency domain from the CFR signal useful in distinguishing various CSD modes.

Abstract: A computing device processor may be configured with processor-executable instructions to implement methods of detecting and responding non-benign behaviors of the computing device. The processor may be configured to monitor device behaviors to collect behavior information, generate a behavior vector information structure based on the collected behavior information, apply the behavior vector information structure to a classifier model to generate analysis results, use the analysis results to classify a behavior of the device, use the analysis results to determine the features evaluated by the classifier model that contributed most to the classification of the behavior, and select the top “n” (e.g., 3) features that contributed most to the classification of the behavior. The computing device may display the selected features on an electronic display of the computing device.

Abstract: Systems, methods, and devices of the various aspects enable detecting anomalous electromagnetic (EM) emissions from among a plurality of electronic devices. A device processor may receive EM emissions of a plurality of electronic devices, wherein the receiving device has no previous information about any of the plurality of electronic devices. The device processor may cross-correlate the EM emissions of the plurality of electronic devices over time. The device processor may identify a difference of the cross-correlated EM emissions from earlier cross-correlated EM emissions. The device processor may determine that the difference of the cross-correlated EM emissions from the earlier cross-correlated EM emissions indicates an anomaly in one or more of the plurality of electronic devices.