By Ellen Muraskin

Qualcomm Technologies has introduced a new defense in the fight against zero-day malware threats to mobile devices.

Snapdragon Smart Protect, an application that will run on Qualcomm’s upcoming Snapdragon 820 processor, will employ real-time machine learning on an advanced cognitive computing behavioral engine to analyze and detect new threats — attacks too new to be removed by signature updates.

What kinds of behavior might tip off this sentry to malware? On its blog, Qualcomm gives the example of a phone snapping a picture even though its screen is locked, or sending out text messages without detecting any user interaction.

The application is the first to use Qualcomm’s Zeroth platform, described as the mobile manufacturer’s first “cognitive compting platform, designed for on-device intelligence.” Its role in Smart Protect is to sense, learn and distinguish “normal” app behavior from anomalous, i.e. potentially malware-driven, activity.

Works Without Internet Access

Snapdragon Smart Protect’s APIs can also be used by anti-malware app developers to perform causal analysis, offering users and the mobile industry at large real-time reporting on identified threats. Equally important, resident on the processor, this behavioral-analysis technology does not depend on an Internet connection to operate.

Asaf Ashkenazi, product-management director for Qualcomm Technologies, pointed out in a release that with Qualcomm’s access to lower layers of the software stack and dedicated security hardware, his company was “uniquely equipped” to come up with a device-based, behavioral analysis approach to data protection, and to do so without intolerable hits to battery life or device performance. The latest Snapdragon’s processor in the 800 series, the 810, goes into Android smartphones from LG, ZTE, OnePlus, and HTC, and Sony Tablets. Other Snapdragons go into Samsung, Blackberry, and Windows phones.

Qualcomm is working with mobile security providers like Avast, AVG and Lookout to work its behavioral detection into their mobile-device-management (MDM) and security applications. Using Smart Protect and an MDM tool, enterprises and operators will be able to alert users to infected phones or remotely disable them. This can not only protect personal or company data, it can reduce the fraudulent charges and runaway network usage that often stem from such attacks.

Qualcomm is packaging Snapdragon Smart Protect within its larger Haven security suite, which also offers hardware-based protection, fingerprint validation and content protection. It is due to appear in consumer devices in 2016, in conjunction with the Snapdragon 820 processor.