Patent ID: 9369476
Filing Date: 2016-06-14
CPC Classification: G06F,G06N,H04L,H04W

Claim Text:
1. A method for protecting a mobile communication device in a cellular network from unauthorized harmful applications, wherein the mobile communication device comprises electronic circuits, a processor, local data storage units, a graphical user interface (GUI), and a traffic detection application installed on the mobile communication device; the method comprising: a) executing Registration software in the traffic detection application to activate the processor to extract from a local storage unit a list of all applications installed on the mobile communication device and mobile communication device identifiers; b) executing Configuration Manager software in the traffic detection application to activate the processor to receive and load in a local storage unit configuration parameters; c) executing Logging software in the traffic detection application to activate the processor to record in a local storage unit specified events in log files on the mobile communication device; d) executing Features Extraction Manager software in the traffic detection application to manage extraction, aggregation and learning processes according to defined time intervals by: i) executing Features Extraction software in the traffic detection application to activate the processor to perform measurement of defined features at defined time periods and to store the measurements in a Features storage unit; ii) executing Features Aggregation software in the traffic detection application to activate the processor to compute and store in the Features storage unit defined aggregations over all the extracted measurements for the specified time period; iii) executing Local Learner software in the traffic detection application to activate the processor to induce from the defined aggregations that are stored in the Features storage unit local models representing an application's normal traffic patterns specific for the mobile communication device on which it is installed and to store the induced local models in a Models storage unit; e) executing Models Manager software in the traffic detection application to activate the processor to perform operations related to the models stored in the Models storage unit; f) executing Anomaly Detector software in the traffic detection application to activate the processor to perform online analysis of an application's network behavior and to detect deviations from normal behavior patterns; and g) executing Alerts Handler software in the traffic detection application to activate the processor to present alerts to a user on the GUI of the mobile communication device when a deviation from the normal behavior pattern of an application is detected; wherein, all software of the application is installed and run on a single mobile communication device, to analyze network behavior of applications running on the mobile communication device and detect meaningful deviations from the application's observed normal behavior; thereby to detect previously unknown malware applications based only on the data available on the mobile communication device, independently of other mobile communication devices or servers present in the cellular network.