Patent Document ID: 9607146
Application ID: 14030053
Patent Flag: 1

Claim One:
1. A method of analyzing mobile device behaviors to identify a non-benign software application, comprising: identifying in a processor of a mobile device a critical data resource in the mobile device that requires close monitoring; identifying, via the processor of the mobile device, an intermediate resource in the mobile device that is associated with the critical data resource; monitoring, via the processor of the mobile device, activities of both the identified critical data resource and the identified intermediate resource in the mobile device to collect behavior information that identifies a pattern of API calls indicative of non-benign activity by a software application that is operating on the mobile device; generating, via the processor of the mobile device, a light-weight behavior signature based on the collected behavior information that identifies the pattern of API calls indicative of non-benign activity by the software application; performing behavior-based analysis operations that include: using the generated light-weight behavior signature to identify two or more operations of the software application that should be analyzed together as a single mobile device behavior; generating a behavior vector based on the identified two or more operations; and applying the generated behavior vector to a machine learning classifier model to generate analysis results; and using the generated analysis results to determine whether the software application is not benign.