Location based process-monitoring

Abstract

Disclosed are systems, apparatus, devices, methods, computer program products, and other implementations, including a method that includes determining location of a device, and controlling monitoring of behavior of one or more processes executing on the device based on the determined location of the device to identify potential one or more security-risky processes from the monitored one or more executing processes. In some embodiments, controlling the monitoring of the behavior of the one or more processes may include one or more of, for example, adjusting frequency of the monitoring of the one or more processes based on the determined location of the device, adjusting level of detail obtained for the monitored behavior of the one or more processes based on the determined location of the device, and/or adjusting features being observed for the monitored one or more processes based on the determined location of the device.

What is claimed is: 
     
         1 . A method comprising:
 determining, by a mobile device, a location of the mobile device;   determining, by the mobile device, a security type for an area corresponding to an identifiable geographic region for the determined location of the mobile device;   controlling, by the mobile device, adjustable monitoring operations to monitor behavior of one or more processes executing on the mobile device based on the determined security type for the area, the adjustable monitoring operations configured to provide monitoring data for the one or more processes to identify potential one or more security-risky processes from the one or more processes; and   classifying, by the mobile device, at least one of the one or more processes as being a risky or non-risky activity based, at least in part, on the monitoring data provided by the adjustable monitoring operations and the determined security type for the area.   
     
     
         2 . The method of  claim 1 , wherein controlling the adjustable monitoring operations further comprises:
 adjusting which processes and which features of the one or more processes to monitor based on the determined security type for the area.   
     
     
         3 . The method of  claim 1 , wherein the adjustable monitoring operations configured to provide the monitoring data are configured to provide the monitoring data with a level of information that depends on the determined security type for the area. 
     
     
         4 . The method of  claim 1 , wherein the one or more security-risky processes comprise one or more of:
 a malicious process of a third party, or a process initiated by a user of the mobile device that causes a potential security risk.   
     
     
         5 . The method of  claim 1 , wherein determining the location of the mobile device comprises:
 determining one or more of: a global geographical position coordinates corresponding to the location of the mobile device, a location context identifier for the mobile device, or another identifier associated with the location of the mobile device.   
     
     
         6 . The method of  claim 1 , wherein determining the security type for the area corresponding to the identifiable geographic region for the determined location of the mobile device comprises:
 determining the security type for the area as being one of: a secure public location, a non-secure public location, a secure private location, or a non-secure private location.   
     
     
         7 . The method of  claim 1 , wherein controlling the adjustable monitoring operations to monitor the behavior of the one or more processes executing on the mobile device based on the determined security type for the area comprises one or more of:
 adjusting frequency of the adjustable monitoring operations to monitor the one or more processes executing on the mobile device based on the determined security type for the area; or   adjusting level of detail of the monitoring data provided for the monitored behavior of the one or more processes executing on the mobile device based on the determined security type for the area.   
     
     
         8 . The method of  claim 7 , wherein adjusting the frequency of the adjustable monitoring operations to monitor the one or more processes executing on the mobile device comprises:
 increasing the frequency of observation for at least some of the one or more processes executing on the mobile device in response to a determination that the device is located in a secure area.   
     
     
         9 . The method of  claim 7 , wherein adjusting the level of detail obtained for the monitored behavior of the one or more processes executing on the mobile device comprises:
 increasing the level of detail of the monitoring data in response to a determination that the device is located in a secure area.   
     
     
         10 . The method of  claim 1 , wherein classifying the at least one of the one or more processes comprises:
 identifying the monitored behavior of the at least one of the one or more processes as potentially malicious behavior in response to a determination that number of uses of a particular feature exceeds a pre-determined threshold when the mobile device is determined to be in a secure area.   
     
     
         11 . The method of  claim 10 , wherein the particular feature comprises at least one of:
 image capturing using a camera of the mobile device, or data transfer over a communication link between the mobile device and a remote device.   
     
     
         12 . The method of  claim 10 , wherein identifying the monitored behavior of the at least one of the one or more processes as potentially malicious behavior comprises:
 identifying image capturing operations using a camera of the mobile device as being malicious behavior when the number of uses of the camera during a pre-determined time interval exceeds a pre-determined camera use threshold and when the mobile device is determined to be in the secure area.   
     
     
         13 . The method of  claim 1 , wherein classifying the at least one of the one or more processes comprises:
 identifying the monitored behavior of the at least one of the one or more processes as potentially malicious behavior using a machine-learning procedure.   
     
     
         14 . The method of  claim 1 , wherein controlling the adjustable monitoring operations to monitor the behavior of the one or more processes comprises:
 determining, from a plurality of activities performable on the mobile device, the one or more processes to monitor.   
     
     
         15 . A mobile device comprising:
 a transceiver;   memory to store computer instructions; and   one or more processors coupled to the memory and the transceiver, and configured to:
 determine a location of the mobile device; 
 determine a security type for an area corresponding to an identifiable geographic region for the determined location of the mobile device; 
 control adjustable monitoring operations to monitor behavior of one or more processes executing on the mobile device based on the determined security type for the area, the adjustable monitoring operations configured to provide monitoring data for the one or more processes to identify potential one or more security-risky processes from the one or more processes; and 
 classify at least one of the one or more processes as being a risky or non-risky activity based, at least in part, on the monitoring data provided by the adjustable monitoring operations and the determined security type for the area. 
   
     
     
         16 . The mobile device of  claim 15 , wherein the one or more processors configured to control the adjustable monitoring operations are further configured to:
 adjust which processes and which features of the one or more processes to monitor based on the determined security type for the area.   
     
     
         17 . The mobile device of  claim 15 , wherein the one or more security-risky processes comprise one or more of:
 a malicious process of a third party, or a process initiated by a user of the mobile device that causes a potential security risk.   
     
     
         18 . The mobile device of  claim 15 , wherein the one or more processors configured to determine the security type for the area corresponding to the identifiable geographic region for the determined location of the mobile device are further configured to:
 determine the security type for the area as being one of: a secure public location, a non-secure public location, a secure private location, or a non-secure private location.   
     
     
         19 . The mobile device of  claim 15 , wherein the one or more processors configured to control the adjustable monitoring operations to monitor the behavior of the one or more processes executing on the mobile device based on the determined security type for the area are configured to perform one or more of:
 adjust frequency of the adjustable monitoring operations to monitor the one or more processes executing on the mobile device based on the determined security type for the area; or   adjust level of detail of the monitoring data provided for the monitored behavior of the one or more processes executing on the mobile device based on the determined security type for the area.   
     
     
         20 . The mobile device of  claim 15 , wherein the one or more processors configured to adjust the frequency of the adjustable monitoring operations to monitor the one or more processes executing on the mobile device are configured to:
 increase the frequency of observation for at least some of the one or more processes executing on the mobile device in response to a determination that the device is located in a secure area.   
     
     
         21 . The mobile device of  claim 15 , wherein the one or more processors configured to classify the at least one of the one or more processes are configured to:
 identify the monitored behavior of the at least one of the one or more processes as potentially malicious behavior in response to a determination that number of uses of a particular feature exceeds a pre-determined threshold when the mobile device is determined to be in a secure area.   
     
     
         22 . The mobile device of  claim 21 , wherein the particular feature comprises at least one of:
 image capturing using a camera of the mobile device, or data transfer over a communication link between the mobile device and a remote device.   
     
     
         23 . An apparatus comprising:
 means for determining, by a mobile device, a location of the mobile device;   means for determining, by the mobile device, a security type for an area corresponding to an identifiable geographic region for the determined location of the mobile device;   means for controlling, by the mobile device, adjustable monitoring operations to monitor behavior of one or more processes executing on the mobile device based on the determined security type for the area, the adjustable monitoring operations configured to provide monitoring data for the one or more processes to identify potential one or more security-risky processes from the one or more processes; and   means for classifying, by the mobile device, at least one of the one or more processes as being a risky or non-risky activity based, at least in part, on the monitoring data provided by the adjustable monitoring operations and the determined security type for the area.   
     
     
         24 . The apparatus of  claim 23 , wherein the means for controlling the adjustable monitoring operations comprises:
 means for adjusting which processes and which features of the one or more processes to monitor based on the determined security type for the area.   
     
     
         25 . The apparatus of  claim 23 , wherein the means for controlling the adjustable monitoring operations to monitor the behavior of the one or more processes executing on the mobile device based on the determined security type for the area comprises one or more of:
 means for adjusting frequency of the adjustable monitoring operations to monitor the one or more processes executing on the mobile device based on the determined security type for the area; or   means for adjusting level of detail of the monitoring data provided for the monitored behavior of the one or more processes executing on the mobile device based on the determined security type for the area.   
     
     
         26 . The apparatus of  claim 23 , wherein the means for classifying the at least one of the one or more processes comprises:
 means for identifying the monitored behavior of the at least one of the one or more processes as potentially malicious behavior in response to a determination that number of uses of a particular feature exceeds a pre-determined threshold when the mobile device is determined to be in a secure area.   
     
     
         27 . A non-transitory computer readable media programmed with instructions, executable on a processor, to:
 determine, by a mobile device, a location of the mobile device;   determine, by the mobile device, a security type for an area corresponding to an identifiable geographic region for the determined location of the mobile device;   control, by the mobile device, adjustable monitoring operations to monitor behavior of one or more processes executing on the mobile device based on the determined security type for the area, the adjustable monitoring operations configured to provide monitoring data for the one or more processes to identify potential one or more security-risky processes from the one or more processes; and   classify, by the mobile device, at least one of the one or more processes as being a risky or non-risky activity based, at least in part, on the monitoring data provided by the adjustable monitoring operations and the determined security type for the area.   
     
     
         28 . The computer readable media of  claim 27 , wherein the instructions to control the adjustable monitoring operations comprise one or more instructions to:
 adjust which processes and which features of the one or more processes to monitor based on the determined security type for the area.   
     
     
         29 . The computer readable media of  claim 27 , wherein the instructions to control the adjustable monitoring operations to monitor the behavior of the one or more processes executing on the mobile device based on the determined security type for the area comprise one or more instruction to perform one or more of:
 adjust frequency of the adjustable monitoring operations to monitor the one or more processes executing on the mobile device based on the determined security type for the area; or   adjust level of detail of the monitoring data provided for the monitored behavior of the one or more processes executing on the mobile device based on the determined security type for the area.   
     
     
         30 . The computer readable media of  claim 27 , wherein the instructions to classify the at least one of the one or more processes comprise one or more instructions to:
 identify the monitored behavior of the at least one of the one or more processes as potentially malicious behavior in response to a determination that number of uses of a particular feature exceeds a pre-determined threshold when the mobile device is determined to be in a secure area.