US 12,488,103 B2
Protecting against malicious application encounters on mobile devices
Savino Dambra, Nice (FR); Platon Kotzias, Athens (GR); and Leylya Yumer, Antibes (FR)
Assigned to GEN DIGITAL, INC., Tempe, AZ (US)
Filed by Gen Digital Inc., Tempe, AZ (US)
Filed on Sep. 7, 2023, as Appl. No. 18/462,809.
Claims priority of application No. 23386081 (EP), filed on Aug. 30, 2023.
Prior Publication US 2025/0077660 A1, Mar. 6, 2025
Int. Cl. H04L 29/00 (2006.01); G06F 21/55 (2013.01); G06F 21/56 (2013.01); H04L 9/40 (2022.01)
CPC G06F 21/554 (2013.01) [G06F 21/56 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for protecting against malicious application encounters, at least a portion of the method being performed by a computing device comprising one or more processors, the method comprising:
obtaining application data and feature data from a plurality of mobile devices;
identifying one or more malicious applications installed on each mobile device within the plurality of mobile devices;
determining, based on the application data, a user profile for each mobile device within the plurality of mobile devices;
assigning each mobile device within the plurality of mobile devices to a cluster based on the user profile identified for each mobile device within the plurality of mobile devices such that each cluster includes a subset of mobile devices from the plurality of mobile devices;
creating, based on the feature data, a security model for a particular cluster, wherein the feature data relates to a distribution of application signers or application categories by each mobile device within the subset of mobile devices and one or more feature classes from a subset of mobile devices from the plurality of mobile devices that are assigned to the particular cluster, the one or more feature classes including volume, diversity, updates, distribution, prevalence, or geography;
applying the security model to a selected mobile device from the plurality of mobile devices that is within the particular cluster; and
performing a security action on the selected mobile device based on an output of the security model.