Abstract: The various aspects provide a system and methods implemented on the system for generating a behavior model on a server that includes features specific to a mobile computing device and the device's current state/configuration. In the various aspects, the mobile computing device may send information identifying itself, its features, and its current state to the server. In response, the server may generate a device-specific lean classifier model for the mobile computing device based on the device's information and state and may send the device-specific lean classifier model to the device for use in detecting malicious behavior. The various aspects may enhance overall security and performance on the mobile computing device by leveraging the superior computing power and resources of the server to generate a device-specific lean classifier model that enables the device to monitor features that are actually present on the device for malicious behavior.

Abstract: Certain aspects of the present disclosure relate to a method for enhanced multichannel access where multiple simultaneous transmissions can occur each spanning a subset of frequency bands.

Abstract: Methods and apparatuses are provided which may be implemented in various devices having one or more computing platforms to obtain signaling characteristics for one or more transmitting devices. The signaling characteristics may, for example, be based, at least in part, on one or more signals received by a receiving device from the transmitting device(s), and may comprise at least a received signal strength measurement and a propagation time measurement. Such methods and apparatuses may further be implemented to determine whether a mobile station is to use or not use positioning data for one or more transmitting device(s) in a positioning function based, at least in part, on the received signal strength measurement and the propagation time measurement.

Abstract: Various methods, apparatuses and/or articles of manufacture are provided which may be implemented for use by a mobile device to alter a scan operation. Various methods, apparatuses and/or articles of manufacture are provided which may be implemented for use by one or more electronic devices to determine one or more scan factors for use by a mobile device in altering a scan operation.

Abstract: Methods and apparatuses of providing assistance data of a venue to a mobile device are disclosed. According to aspects of the present disclosure, for the same area, multiple or different versions of assistance data may be generated. Restrictions may be applied by access area, such that positioning grid, heat maps, and maps can be restricted to certain sections of the venue; and point of interests (POIs) and search features may be provided based on at least one of user credentials, time-based restrictions, ticket-based restrictions, or loyalty-based restrictions, or any combination thereof.

Abstract: A computing device may be configured to work in conjunction with another component (e.g., a server) to better determine whether a software application is benign or non-benign. This may be accomplished via the server performing static and/or dynamic analysis operations, generating a behavior information structure that describes or characterizes the range of correct or expected behaviors of the software application, and sending the behavior information structure to a computing device. The computing device may compare the received behavior information structure to a locally generated behavior information structure to determining whether the observed behavior of the software application differs or deviates from the expected behavior of the software application or whether the observed behavior is within the range of expected behaviors. The computing device may increase its level of security/scrutiny when the behavior information structure does not match the local behavior information structure.

Abstract: Methods, and devices implementing the methods, use device-specific classifiers in a privacy-preserving behavioral monitoring and analysis system for crowd-sourcing of device behaviors. Diverse devices having varying degrees of “smart” capabilities may monitor operational behaviors. Gathered operational behavior information may be transmitted to a nearby device having greater processing capabilities than a respective collecting device, or may be transmitted directly to an “always on” device. The behavior information may be used to generate behavior vectors, which may be analyzed for anomalies. Vectors containing anomaly flags may be anonymized to remove any user-identifying information and subsequently transmitted to a remote recipient such as a service provider or device manufacture.

Abstract: Methods and devices for detecting suspicious or performance-degrading mobile device behaviors may include performing behavior monitoring and analysis operations to intelligently, dynamically, and/or adaptively determine the mobile device behaviors that are to be observed, the number of behaviors that are to be observed, and the level of detail or granularity at which the behaviors are to be observed. Such behavior monitoring and analysis operations may be performed continuously (or near continuously) in a mobile device without consuming an excessive amount of processing, memory, or energy resources of the mobile device by identifying hot application programming interfaces (APIs) and hot action patterns that are invoked or used most frequently by software applications of the mobile device and storing information regarding these hot APIs and hot action patterns separately and more efficiently.

Abstract: Systems, methods, and apparatus for extended reverse direction grant in a WLAN are provided. In one aspect, a method for communication using a channel that is common to a plurality of nodes is provided. The method includes transmitting first data to the plurality of nodes using a first transmission resource. The first data is transmitted within a transmit opportunity time interval and comprises a first indicator. The method further includes receiving, in response to the first indicator, at least one data transmission from at least one of the nodes, respectively. The at least one data transmitted using at least one second transmission resource, respectively, and is received within the transmit opportunity time interval.

Abstract: An apparatus and method for communications are disclosed. The apparatus may include a transceiver, and a processing system configured to dynamically allocate a plurality of channels to one or more nodes prior to a data transmission from the transceiver to the one or more nodes. Further, an access terminal and method for communications are disclosed, wherein the access terminal may include a processing system configured to receive from another access terminal a dynamic allocation of a plurality of channels prior to a data transmission, and a transceiver configured to receive the data transmission from the other access terminal on the channels.

Abstract: The disclosure generally relates to behavioral analysis to automate monitoring Internet of Things (IoT) device health in a direct and/or indirect manner. In particular, normal behavior associated with an IoT device in a local IoT network may be modeled such that behaviors observed at the IoT device may be compared to the modeled normal behavior to determine whether the behaviors observed at the IoT device are normal or anomalous. Accordingly, in a distributed IoT environment, more powerful “analyzer” devices can collect behaviors locally observed at other (e.g., simpler) “observer” devices and conduct behavioral analysis across the distributed IoT environment to detect anomalies potentially indicating malicious attacks, malfunctions, or other issues that require customer service and/or further attention.

Abstract: Various aspects include methods and computing devices implementing the methods for evaluating device behaviors in the computing devices. Aspect methods may include using a behavior-based machine learning technique to classify a device behavior as one of benign, suspicious, and non-benign. Aspect methods may include using one of a multi-label classification and a meta-classification technique to sub-classify the device behavior into one or more sub-categories. Aspect methods may include determining a relative importance of the device behavior based on the sub-classification, and determining whether to perform robust behavior-based operations based on the determined relative importance of the device behavior.

Abstract: Systems and methods of network based positioning include a server configured to assign priority levels to mobile devices locatable within the network, and allocate network resources for network based positioning of the locatable mobile devices, based on the corresponding priority levels assigned to the mobile devices. The server may further be configured to admit only a selected subset of the locatable mobile devices into the network for purposes of network based positioning and deny admission to the remaining locatable mobile devices, wherein the selected subset can be determined based on an attribute of the mobile device and/or a characteristic of the user of the mobile device.

Abstract: Systems and methods are disclosed for automating customer service for a monitored device (MD). A method for an Internet of Everything management device to automate customer service for a monitored device comprises collecting sensor data from a plurality of sensors, wherein the plurality of sensors comprises a first sensor that is not included in the MD, determining whether the MD is exhibiting abnormal behavior based on an analysis of the collected sensor data, and transmitting a report to a customer service entity associated with the MD in response to a determination that the MD is exhibiting abnormal behavior.

Abstract: Systems, methods, and devices of the various aspects enable detecting a malfunction caused by radio frequency (RF) interference. A computing device processor may identify a location of the computing device based on a plurality of real-time data inputs received by the computing device. The processor may characterize an RF environment of the computing device based on the identified location and the plurality of real-time data inputs. The processor may determine at least one RF emissions threshold based on the characterization of the RF environment. The processor may compare the characterization of the RF environment to the at least one RF emissions threshold, and may perform an action in response to determining that the characterization of the RF environment exceeds the at least one RF emissions threshold.

Abstract: Methods, systems and devices for identifying, classifying, modeling, and responding to mobile device behaviors may include using lightweight processes to monitor and analyze various conditions and device behaviors to detect an instance of a non-benign behavior, increasing a level of security or scrutiny to identify other instances of non-benign behavior, and notifying select computing devices of the increased security risk so that they may also increase their security/scrutiny levels. For example, a computing device may be configured to perform a first type of analysis operations (e.g., lightweight analysis operations) to determine whether there is an increased security risk, and perform a second type of analysis operations (e.g., robust analysis operations) in response to determining that there is an increased security risk to determine whether there are additional security risks that are different from the security risk detected via the performance of the first type of analysis operations.

Abstract: A computing device processor may be configured with processor-executable instructions to implement methods of detecting and responding to fake user interaction (UI) events. The processor may determine whether a user interaction event is a fake user interaction event by analyzing raw data generated by one or more hardware drivers in conjunction with user interaction event information generated or received by the high-level operating system. In addition, the processor may be configured with processor-executable instructions to implement methods of using behavioral analysis and machine learning techniques to identify, prevent, correct, or otherwise respond to malicious or performance-degrading behaviors of the computing device based on whether a detected user interaction event is an authentic or fake user interaction event.

Abstract: Various methods, apparatuses and/or articles of manufacture are provided which may be implemented for use by a mobile device to alter a scan operation. Various methods, apparatuses and/or articles of manufacture are provided which may be implemented for use by one or more electronic devices to determine one or more scan factors for use by a mobile device in altering a scan operation.

Abstract: Methods and devices for tracking data flows in a computing device include monitoring memory in a hardware component of the computing device to identify a read operation that reads information from a tainted memory address, using heuristics to identify a first, second, and third number of operations performed after the identified read operation, marking memory addresses of write operations performed after first number of operations and before the second number of operations as tainted, and marking memory addresses of write operations performed after the third number of operations and before the second number of operations as untainted.

Abstract: In one implementation, a method may comprise: obtaining a digital map of an indoor region that identifies boundaries between subsections within the indoor region; and approximating locations of walls separating rooms within at least one of the subsections based, at least in part, on locations of feature labels provided in the digital map.