Various aspects provide methods implemented by at least one processor executing on a mobile communication device to efficiently identify, classify, model, prevent, and/or correct the non-benign (e.g., performance degrading) conditions and/or behaviors that are related to an application operating on the device. Specifically, in various aspects, the mobile computing device may derive or extract application-specific features by performing a binary analysis of an application and may determine the application's category (e.g., a “games,” “entertainment,” or “news” category) based on the application-specific features. The mobile computing device may also obtain a classifier model associated with the application's category that includes various conditions, features, behaviors and corrective actions that may be used to quickly identify and correct non-benign behaviors (e.g., undesirable, malicious, and/or performance-degrading behaviors) occurring on the mobile computing device that are related to the application.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method of generating data models in a mobile computing device in response to deriving a set of features specific to an application based on a lightweight binary analysis of the application, comprising: categorizing the application based on the set of application-specific features; and obtaining a classifier model based on a category of the application. 2. The method of claim 1, wherein the set of application-specific features is generated by: extracting a set of features related to the application based on the lightweight binary analysis of the application; comparing the extracted set of features with a list of generic features; and removing any feature in the set of extracted features that matches a feature in the list of generic features to produce the set of application-specific features. 3. The method of claim 1, wherein categorizing the application based on the set of application-specific features comprises: classifying behaviors of the application with a generic classifier model; determining whether there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model based on the classified behaviors; deriving a set of features specific to the application based on a lightweight binary analysis of the application performed in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model; and categorizing the application based on the set of application-specific features derived from the lightweight binary analysis of the application performed in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model. 4. The method of claim 1, wherein obtaining a classifier model based on the category of the application comprises: comparing the category of the application with a list of categories associated with previously generated classifier models; determining whether the category of the application matches a category included in the list of categories; obtaining a previously generated classifier model associated with a matching category included in the list of categories in response to determining that the category of the application matches the matching category; and obtaining a new classifier model based on the set of application-specific features in response to determining that the category of the application does not match a category in the list of categories. 5. The method of claim 1, further comprising: observing behaviors of the set of application-specific features; generating a behavior vector for the application based on the observed behaviors; and applying the behavior vector to the classifier model to detect non-benign behavior on the mobile computing device related to the application. 6. The method of claim 5, further comprising: identifying features related to the application that are occurring on the mobile computing device based on the observed behaviors; determining whether there is a non-trivial difference between the features related to the application that are occurring on the mobile computing device and the set of application-specific features included in the classifier model; and obtaining a different classifier model based on the features related to the application that are occurring on the mobile computing device in response to determining that there is a non-trivial difference between the features related to the application that are occurring on the mobile computing device and the set of application-specific features included in the classifier model. 7. The method of claim 5, wherein: applying the behavior vector to the classifier model to detect non-benign behavior on the mobile computing device related to the application comprises applying the behavior vector to the classifier model to generate a behavior classification determination and a confidence value associated with the behavior classification determination; and the method further comprises: determining whether the confidence value associated with the behavior classification determination is less than a low-confidence threshold value; determining whether there is a consistent history of behavior classification determinations with low-confidence values associated with the classifier model in response to determining that the confidence value associated with the behavior classification determination is less than the low-confidence threshold value; obtaining a refined classifier model associated with the category of the application in response to determining that there is not a consistent history of behavior classification determinations with low-confidence values associated with the classifier model; and performing an analysis of the set of application-specific features to determine a new category for the application and obtaining another classifier model based on the new category of the application in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the classifier model. 8. A mobile computing device, comprising: a memory; and a processor coupled to the memory and configured with processor-executable instructions to perform operations comprising: categorizing an application based on a set of application-specific features; and obtaining a classifier model based on a category of the application. 9. The mobile computing device of claim 8, wherein the processor is configured with processor-executable instructions to perform operations such that the set of application-specific features is generated by: extracting a set of features related to the application based on a lightweight binary analysis of the application; comparing the set of extracted features with a list of generic features; and removing any feature in the set of extracted features that matches a feature in the list of generic features to produce the set of application-specific features. 10. The mobile computing device of claim 8, wherein the processor is configured with processor-executable instructions to perform operations such that categorizing the application based on a set of application-specific features comprises: classifying behaviors of the application with a generic classifier model; determining whether there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model based on the classified behaviors; deriving a set of features specific to the application based on a lightweight binary analysis of the application performed in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model; and categorizing the application based on the set of application-specific features derived from the lightweight binary analysis of the application performed in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model. 11. The mobile computing device of claim 8, wherein the processor is configured with processor-executable instructions to perform operations such that obtaining a classifier model based on the category of the application comprises: comparing the category of the application with a list of categories associated with previously generated classifier models; determining whether the category of the application matches a category included in the list of categories; obtaining a previously generated classifier model associated with a matching category included in the list of categories in response to determining that the category of the application matches the matching category; and obtaining a new classifier model based on the set of application-specific features in response to determining that the category of the application does not match a category in the list of categories. 12. The mobile computing device of claim 8, wherein the processor is configured with processor-executable instructions to perform operations further comprising: observing behaviors of the set of application-specific features; generating a behavior vector for the application based on the observed behaviors; and applying the behavior vector to the classifier model to detect non-benign behavior on the mobile computing device related to the application. 13. The mobile computing device of claim 12, wherein the processor is configured with processor-executable instructions to perform operations further comprising: identifying features related to the application that are occurring on the mobile computing device based on the observed behaviors; determining whether there is a non-trivial difference between the features related to the application that are occurring on the mobile computing device and the set of application-specific features included in the classifier model; and obtaining a different classifier model based on the features related to the application that are occurring on the mobile computing device in response to determining that there is a non-trivial difference between the features related to the application that are occurring on the mobile computing device and the set of application-specific features included in the classifier model. 14. The mobile computing device of claim 12, wherein: the processor is configured with processor-executable instructions to perform operations such that applying the behavior vector to the classifier model to detect non-benign behavior on the mobile computing device related to the application comprises applying the behavior vector to the classifier model to generate a behavior classification determination and a confidence value associated with the behavior classification determination; and the processor is configured with processor-executable instructions to perform operations further comprising: determining whether the confidence value associated with the behavior classification determination is less than a low-confidence threshold value; determining whether there is a consistent history of behavior classification determinations with low-confidence values associated with the classifier model in response to determining that the confidence value associated with the behavior classification determination is less than the low-confidence threshold value; obtaining a refined classifier model associated with the category of the application in response to determining that there is not a consistent history of behavior classification determinations with low-confidence values associated with the classifier model; and performing an analysis of the set of application-specific features to determine a new category for the application and obtaining another classifier model based on the new category of the application in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the classifier model. 15. A non-transitory computer-readable storage medium having stored thereon processor-executable software instructions configured to cause a processor of a mobile computing device to perform operations comprising: categorizing an application based on a set of application-specific features; and obtaining a classifier model based on a category of the application. 16. The non-transitory computer-readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that the set of application-specific features is generated by: extracting a set of features related to the application based on a lightweight binary analysis of the application; comparing the set of extracted features with a list of generic features; and removing any feature in the set of extracted features that matches a feature in the list of generic features to produce the set of application-specific features. 17. The non-transitory computer-readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that categorizing the application based on a set of application-specific features comprises: classifying behaviors of the application with a generic classifier model; determining whether there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model based on the classified behaviors; deriving a set of features specific to the application based on a lightweight binary analysis of the application performed in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model; and categorizing the application based on the set of application-specific features derived from the lightweight binary analysis of the application performed in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the generic classifier model. 18. The non-transitory computer-readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that obtaining a classifier model based on the category of the application comprises: comparing the category of the application with a list of categories associated with previously generated classifier models; determining whether the category of the application matches a category included in the list of categories; obtaining a previously generated classifier model associated with a matching category included in the list of categories in response to determining that the category of the application matches the matching category; and obtaining a new classifier model based on the set of application-specific features in response to determining that the category of the application does not match a category in the list of categories. 19. The non-transitory computer-readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising: observing behaviors of the set of application-specific features; generating a behavior vector for the application based on the observed behaviors; applying the behavior vector to the classifier model to detect non-benign behavior on the mobile computing device related to the application; identifying features related to the application that are occurring on the mobile computing device based on the observed behaviors; determining whether there is a non-trivial difference between the features related to the application that are occurring on the mobile computing device and the set of application-specific features included in the classifier model; and obtaining a different classifier model based on the features related to the application that are occurring on the mobile computing device in response to determining that there is a non-trivial difference between the features related to the application that are occurring on the mobile computing device and the set of application-specific features included in the classifier model. 20. The non-transitory computer-readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising: observing behaviors of the set of application-specific features; generating a behavior vector for the application based on the observed behaviors; applying the behavior vector to the classifier model to generate a behavior classification determination and a confidence value associated with the behavior classification determination; determining whether the confidence value associated with the behavior classification determination is less than a low-confidence threshold value; determining whether there is a consistent history of behavior classification determinations with low-confidence values associated with the classifier model in response to determining that the confidence value associated with the behavior classification determination is less than the low-confidence threshold value; obtaining a refined classifier model associated with the category of the application in response to determining that there is not a consistent history of behavior classification determinations with low-confidence values associated with the classifier model; performing an analysis of the set of application-specific features to determine a new category for the application and obtaining another classifier model based on the new category of the application in response to determining that there is a consistent history of behavior classification determinations with low-confidence values associated with the classifier model.