US 11,868,483 B2
Device-based security scoring
Victoria Ashley Mosby, Frederick, MD (US); Bastien Bobe, Mogneneins (FR); Brian James Buck, Livermore, CA (US); and Katelyn Clifford, Boston, MA (US)
Assigned to LOOKOUT INC., Boston, MA (US)
Filed by Lookout Inc., San Francisco, CA (US)
Filed on Nov. 8, 2022, as Appl. No. 17/983,127.
Application 17/983,127 is a continuation of application No. 16/810,405, filed on Mar. 5, 2020, granted, now 11,537,721.
Prior Publication US 2023/0070546 A1, Mar. 9, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); G06F 21/57 (2013.01); G06F 21/56 (2013.01); G06N 20/00 (2019.01)
CPC G06F 21/577 (2013.01) [G06F 21/566 (2013.01); G06N 20/00 (2019.01); G06F 2221/033 (2013.01); G06F 2221/034 (2013.01)] 14 Claims
OG exemplary drawing
 
1. A method for characterizing security comprising:
receiving, by a computing device, a plurality of factors describing applications installed on a mobile device;
assigning, by the computing device, an application score to the plurality of factors; and
calculating a security score for the mobile device based on the application score;
wherein the plurality of factors includes one or more of:
a number of malware on the mobile device;
a level or risk associated with malware on the mobile device;
a number of the applications that are side-loaded applications not obtained from a trusted source;
a number of the applications accessing cloud storage;
a number of the applications that are messaging applications;
a number of the applications that are out of date; or
a number of the applications that are no longer available in an application store
receiving, by the computing device, authentication behavior of a user with respect to a mobile device for a time period;
processing, by the computing device, the authentication behavior to obtain an authentication score; and
combining the authentication score with the application score to obtain the security score for the mobile device;
wherein the authentication behavior includes one or more of number of failed attempts, login times, login locations, or networks used.