Patent Document ID: 9703962
Application ID: 14510772

Base Claim:
1. A method of analyzing a device behavior in a computing device, comprising: monitoring, by a processor of the computing device, activities of a software application operating on the computing device to generate user-persona information that characterizes a user of the computing device, the generated user-persona information including information that characterizes the user's mood; using the generated user-persona information to select two or more device features; monitoring the selected two or more device features to collect behavior information; determining whether the user's mood is relevant to analyzing the behavior information collected by monitoring the selected two or more device features; and generating a classifier model that includes a plurality of one-level decision trees that each evaluate a device feature in relation to the user's mood in response to determining that the user's mood is relevant to analyzing the behavior information collected by monitoring the selected two or more device features; generating a behavior vector that correlates the behavior information for which the user's mood is relevant to the user's mood at the time the behavior information was collected; applying the generated behavior vector to the classifier model to generate an analysis result; and using the generated analysis result to determine whether the device behavior is non-benign.

---

Claim 4:
4. The method of claim 1 , wherein generating the classifier model that includes the plurality of one-level decision trees that each evaluate a device feature in relation to the user's mood comprises generating a user-specific classifier model that evaluates the selected two or more device features, and wherein applying the generated behavior vector to the classifier model to generate the analysis result comprises applying the generated behavior vector to the user-specific classifier model to generate the analysis result.