WO2024253401A1 - Dispositif électronique et procédé de détection d'application utilisant une ressource de dispositif électronique de façon excessive - Google Patents

Dispositif électronique et procédé de détection d'application utilisant une ressource de dispositif électronique de façon excessive Download PDF

Info

Publication number
WO2024253401A1
WO2024253401A1 PCT/KR2024/007587 KR2024007587W WO2024253401A1 WO 2024253401 A1 WO2024253401 A1 WO 2024253401A1 KR 2024007587 W KR2024007587 W KR 2024007587W WO 2024253401 A1 WO2024253401 A1 WO 2024253401A1
Authority
WO
WIPO (PCT)
Prior art keywords
resource
application
electronic device
threshold value
memory
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/KR2024/007587
Other languages
English (en)
Korean (ko)
Inventor
박언상
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Samsung Electronics Co Ltd
Original Assignee
Samsung Electronics Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from KR1020230082921A external-priority patent/KR20240173569A/ko
Application filed by Samsung Electronics Co Ltd filed Critical Samsung Electronics Co Ltd
Publication of WO2024253401A1 publication Critical patent/WO2024253401A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]

Definitions

  • This article is about electronic devices, and for example, electronic devices that can install and run various applications that utilize the resources of the electronic device.
  • Electronic devices such as smart phones, tablet PCs, laptop PCs, and smart watches include various types of operating systems (or platforms) and can install and execute various applications that can be executed on each operating system. Users of electronic devices can download applications through online markets and install them on their electronic devices. Such markets have an open structure where developers can freely register applications in the market without any special verification procedures. Since various APIs (application program interfaces) or SDKs (software development kits) are provided to support easy application development, users can also develop necessary applications themselves and release them through the market.
  • APIs application program interfaces
  • SDKs software development kits
  • an application When an application is executed on an electronic device, it may use system resources. Since various applications may be executed simultaneously in the foreground and background on an electronic device, the amount of system resources that a specific application may occupy may be limited. As the types of applications released through the market become more diverse, the number of applications that behave abnormally may also increase. For example, due to a lack of expertise on the part of developers, a specific application may use excessive system resources, affecting the overall performance of the electronic device. Therefore, a technology for detecting such abnormally behaving applications on an electronic device in real time is required.
  • Electronic devices can monitor whether resources are running low below a threshold value to detect applications that are behaving abnormally.
  • conventional technologies have used fixed threshold values to determine whether there is abnormal operation, and therefore, cases may occur where actual abnormal operation is not detected depending on the application.
  • An electronic device may include a memory and a processor operatively connected to the memory.
  • the memory can store a resource usage data set that maps and records a plurality of applications and a plurality of resource usages corresponding to each of the plurality of applications.
  • the memory may store instructions that, when executed by the processor, cause the electronic device to, when the first application is executed, check the usage of at least one resource used by the executed first application, and record the checked usage information of the at least one resource in a resource usage data set stored in the memory.
  • the instructions may further include instructions causing the electronic device to determine at least one first outlier threshold value corresponding to each of the first application and at least one resource used when executing the first application through a predetermined statistical analysis based on a resource usage data set stored in the memory, and to update at least one second outlier threshold value set for each of the first application and the at least one resource, which is previously stored in the memory, based on the determined at least one first outlier threshold value.
  • an electronic device capable of accurately detecting an abnormally behaving application and a method for detecting an application that excessively uses resources of the electronic device can be provided by determining a threshold value that serves as a criterion for excessive resource usage in an electronic device capable of installing and executing various applications through statistical analysis.
  • FIG. 1 is a block diagram of an electronic device within a network environment according to various embodiments.
  • Figure 2 is a block diagram of a program according to one embodiment.
  • FIG. 3 is a schematic diagram illustrating a server device and a plurality of electronic devices according to one embodiment.
  • FIG. 4 is a block diagram of a server device according to one embodiment.
  • FIG. 5 is a block diagram of a process running on a server device and an electronic device according to one embodiment.
  • FIG. 6 illustrates a resource usage data set according to one embodiment.
  • FIG. 7 is a block diagram of a process running on a server device and an electronic device according to one embodiment.
  • FIGS. 8A to 8D illustrate a UI provided when an abnormal operation is detected in an electronic device according to one embodiment.
  • FIGS. 9A to 9D are flowcharts of a method for an electronic device to detect abnormal operation of an application according to one embodiment of the present invention.
  • FIG. 10 is a flowchart of a method for determining an abnormality threshold value of a server device according to one embodiment.
  • FIG. 11 is a block diagram of an electronic device according to one embodiment.
  • FIG. 12 is a block diagram of a process executed in an electronic device according to one embodiment.
  • FIG. 13 is a flowchart of a method for determining an outlier threshold value of an electronic device according to one embodiment.
  • FIG. 1 is a block diagram of an electronic device (101) in a network environment (100) according to various embodiments.
  • the electronic device (101) may communicate with the electronic device (102) via a first network (198) (e.g., a short-range wireless communication network), or may communicate with at least one of the electronic device (104) or the server (108) via a second network (199) (e.g., a long-range wireless communication network).
  • the electronic device (101) may communicate with the electronic device (104) via the server (108).
  • the electronic device (101) may include a processor (120), a memory (130), an input module (150), an audio output module (155), a display module (160), an audio module (170), a sensor module (176), an interface (177), a connection terminal (178), a haptic module (179), a camera module (180), a power management module (188), a battery (189), a communication module (190), a subscriber identification module (196), or an antenna module (197).
  • the electronic device (101) may omit at least one of these components (e.g., the connection terminal (178)), or may have one or more other components added.
  • some of these components e.g., the sensor module (176), the camera module (180), or the antenna module (197) may be integrated into one component (e.g., the display module (160)).
  • the processor (120) may control at least one other component (e.g., a hardware or software component) of an electronic device (101) connected to the processor (120) by executing, for example, software (e.g., a program (140)), and may perform various data processing or calculations.
  • the processor (120) may store a command or data received from another component (e.g., a sensor module (176) or a communication module (190)) in a volatile memory (132), process the command or data stored in the volatile memory (132), and store result data in a nonvolatile memory (134).
  • the processor (120) may include a main processor (121) (e.g., a central processing unit or an application processor) or an auxiliary processor (123) (e.g., a graphics processing unit, a neural processing unit (NPU), an image signal processor, a sensor hub processor, or a communication processor) that can operate independently or together with the main processor (121).
  • a main processor (121) e.g., a central processing unit or an application processor
  • an auxiliary processor (123) e.g., a graphics processing unit, a neural processing unit (NPU), an image signal processor, a sensor hub processor, or a communication processor
  • the auxiliary processor (123) may be configured to use less power than the main processor (121) or to be specialized for a given function.
  • the auxiliary processor (123) may be implemented separately from the main processor (121) or as a part thereof.
  • the auxiliary processor (123) may control at least a portion of functions or states associated with at least one of the components of the electronic device (101) (e.g., the display module (160), the sensor module (176), or the communication module (190)), for example, while the main processor (121) is in an inactive (e.g., sleep) state, or together with the main processor (121) while the main processor (121) is in an active (e.g., application execution) state.
  • the auxiliary processor (123) e.g., an image signal processor or a communication processor
  • the auxiliary processor (123) may include a hardware structure specialized for processing artificial intelligence models.
  • the artificial intelligence models may be generated through machine learning. Such learning may be performed, for example, in the electronic device (101) itself on which the artificial intelligence model is executed, or may be performed through a separate server (e.g., server (108)).
  • the learning algorithm may include, for example, supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning, but is not limited to the examples described above.
  • the artificial intelligence model may include a plurality of artificial neural network layers.
  • the artificial neural network may be one of a deep neural network (DNN), a convolutional neural network (CNN), a recurrent neural network (RNN), a restricted Boltzmann machine (RBM), a deep belief network (DBN), a bidirectional recurrent deep neural network (BRDNN), deep Q-networks, or a combination of two or more of the above, but is not limited to the examples described above.
  • the artificial intelligence model may additionally or alternatively include a software structure.
  • the memory (130) can store various data used by at least one component (e.g., processor (120) or sensor module (176)) of the electronic device (101).
  • the data can include, for example, software (e.g., program (140)) and input data or output data for commands related thereto.
  • the memory (130) can include volatile memory (132) or nonvolatile memory (134).
  • the program (140) may be stored as software in memory (130) and may include, for example, an operating system (142), middleware (144), or an application (146).
  • the input module (150) can receive commands or data to be used in a component of the electronic device (101) (e.g., a processor (120)) from an external source (e.g., a user) of the electronic device (101).
  • the input module (150) can include, for example, a microphone, a mouse, a keyboard, a key (e.g., a button), or a digital pen (e.g., a stylus pen).
  • the audio output module (155) can output an audio signal to the outside of the electronic device (101).
  • the audio output module (155) can include, for example, a speaker or a receiver.
  • the speaker can be used for general purposes such as multimedia playback or recording playback.
  • the receiver can be used to receive an incoming call. According to one embodiment, the receiver can be implemented separately from the speaker or as a part thereof.
  • the display module (160) can visually provide information to an external party (e.g., a user) of the electronic device (101).
  • the display module (160) can include, for example, a display, a holographic device, or a projector and a control circuit for controlling the device.
  • the display module (160) can include a touch sensor configured to detect a touch, or a pressure sensor configured to measure the intensity of a force generated by the touch.
  • the audio module (170) can convert sound into an electrical signal, or vice versa, convert an electrical signal into sound. According to one embodiment, the audio module (170) can obtain sound through an input module (150), or output sound through an audio output module (155), or an external electronic device (e.g., an electronic device (102)) (e.g., a speaker or a headphone) directly or wirelessly connected to the electronic device (101).
  • an electronic device e.g., an electronic device (102)
  • a speaker or a headphone directly or wirelessly connected to the electronic device (101).
  • the sensor module (176) can detect an operating state (e.g., power or temperature) of the electronic device (101) or an external environmental state (e.g., user state) and generate an electric signal or data value corresponding to the detected state.
  • the sensor module (176) can include, for example, a gesture sensor, a gyro sensor, a barometric pressure sensor, a magnetic sensor, an acceleration sensor, a grip sensor, a proximity sensor, a color sensor, an IR (infrared) sensor, a biometric sensor, a temperature sensor, a humidity sensor, or an illuminance sensor.
  • the interface (177) may support one or more designated protocols that may be used to directly or wirelessly connect the electronic device (101) with an external electronic device (e.g., the electronic device (102)).
  • the interface (177) may include, for example, a high definition multimedia interface (HDMI), a universal serial bus (USB) interface, an SD card interface, or an audio interface.
  • HDMI high definition multimedia interface
  • USB universal serial bus
  • SD card interface Secure Digital Card
  • connection terminal (178) may include a connector through which the electronic device (101) may be physically connected to an external electronic device (e.g., the electronic device (102)).
  • the connection terminal (178) may include, for example, an HDMI connector, a USB connector, an SD card connector, or an audio connector (e.g., a headphone connector).
  • the haptic module (179) can convert an electrical signal into a mechanical stimulus (e.g., vibration or movement) or an electrical stimulus that a user can perceive through a tactile or kinesthetic sense.
  • the haptic module (179) can include, for example, a motor, a piezoelectric element, or an electrical stimulation device.
  • the camera module (180) can capture still images and moving images.
  • the camera module (180) can include one or more lenses, image sensors, image signal processors, or flashes.
  • the power management module (188) can manage power supplied to the electronic device (101).
  • the power management module (188) can be implemented as, for example, at least a part of a power management integrated circuit (PMIC).
  • PMIC power management integrated circuit
  • the battery (189) can power at least one component of the electronic device (101).
  • the battery (189) can include, for example, a non-rechargeable primary battery, a rechargeable secondary battery, or a fuel cell.
  • the communication module (190) may support establishment of a direct (e.g., wired) communication channel or a wireless communication channel between the electronic device (101) and an external electronic device (e.g., the electronic device (102), the electronic device (104), or the server (108)), and performance of communication through the established communication channel.
  • the communication module (190) may operate independently from the processor (120) (e.g., the application processor) and may include one or more communication processors that support direct (e.g., wired) communication or wireless communication.
  • the communication module (190) may include a wireless communication module (192) (e.g., a cellular communication module, a short-range wireless communication module, or a GNSS (global navigation satellite system) communication module) or a wired communication module (194) (e.g., a local area network (LAN) communication module or a power line communication module).
  • a wireless communication module (192) e.g., a cellular communication module, a short-range wireless communication module, or a GNSS (global navigation satellite system) communication module
  • a wired communication module (194) e.g., a local area network (LAN) communication module or a power line communication module.
  • a corresponding communication module may communicate with an external electronic device (104) via a first network (198) (e.g., a short-range communication network such as Bluetooth, wireless fidelity (WiFi) direct, or infrared data association (IrDA)) or a second network (199) (e.g., a long-range communication network such as a legacy cellular network, a 5G network, a next-generation communication network, the Internet, or a computer network (e.g., a LAN or WAN)).
  • a first network (198) e.g., a short-range communication network such as Bluetooth, wireless fidelity (WiFi) direct, or infrared data association (IrDA)
  • a second network (199) e.g., a long-range communication network such as a legacy cellular network, a 5G network, a next-generation communication network, the Internet, or a computer network (e.g., a LAN or WAN)
  • a computer network e.g.,
  • the wireless communication module (192) may use subscriber information (e.g., an international mobile subscriber identity (IMSI)) stored in the subscriber identification module (196) to identify or authenticate the electronic device (101) within a communication network such as the first network (198) or the second network (199).
  • subscriber information e.g., an international mobile subscriber identity (IMSI)
  • IMSI international mobile subscriber identity
  • the wireless communication module (192) can support a 5G network and next-generation communication technology after a 4G network, for example, NR access technology (new radio access technology).
  • the NR access technology can support high-speed transmission of high-capacity data (eMBB (enhanced mobile broadband)), terminal power minimization and connection of multiple terminals (mMTC (massive machine type communications)), or high reliability and low latency (URLLC (ultra-reliable and low-latency communications)).
  • eMBB enhanced mobile broadband
  • mMTC massive machine type communications
  • URLLC ultra-reliable and low-latency communications
  • the wireless communication module (192) can support, for example, a high-frequency band (e.g., mmWave band) to achieve a high data transmission rate.
  • a high-frequency band e.g., mmWave band
  • the wireless communication module (192) may support various technologies for securing performance in a high-frequency band, such as beamforming, massive multiple-input and multiple-output (MIMO), full dimensional MIMO (FD-MIMO), array antenna, analog beam-forming, or large scale antenna.
  • the wireless communication module (192) may support various requirements specified in an electronic device (101), an external electronic device (e.g., an electronic device (104)), or a network system (e.g., a second network (199)).
  • the wireless communication module (192) can support a peak data rate (e.g., 20 Gbps or more) for eMBB realization, a loss coverage (e.g., 164 dB or less) for mMTC realization, or a U-plane latency (e.g., 0.5 ms or less for downlink (DL) and uplink (UL) each, or 1 ms or less for round trip) for URLLC realization.
  • a peak data rate e.g., 20 Gbps or more
  • a loss coverage e.g., 164 dB or less
  • U-plane latency e.g., 0.5 ms or less for downlink (DL) and uplink (UL) each, or 1 ms or less for round trip
  • the antenna module (197) can transmit or receive signals or power to or from the outside (e.g., an external electronic device).
  • the antenna module (197) can include an antenna including a radiator formed of a conductor or a conductive pattern formed on a substrate (e.g., a PCB).
  • the antenna module (197) can include a plurality of antennas (e.g., an array antenna).
  • at least one antenna suitable for a communication method used in a communication network, such as the first network (198) or the second network (199) can be selected from the plurality of antennas by, for example, the communication module (190).
  • a signal or power can be transmitted or received between the communication module (190) and the external electronic device through the selected at least one antenna.
  • another component e.g., a radio frequency integrated circuit (RFIC)
  • RFIC radio frequency integrated circuit
  • the antenna module (197) may form a mmWave antenna module.
  • the mmWave antenna module may include a printed circuit board, an RFIC positioned on or adjacent a first side (e.g., a bottom side) of the printed circuit board and capable of supporting a designated high-frequency band (e.g., a mmWave band), and a plurality of antennas (e.g., an array antenna) positioned on or adjacent a second side (e.g., a top side or a side) of the printed circuit board and capable of transmitting or receiving signals in the designated high-frequency band.
  • a first side e.g., a bottom side
  • a plurality of antennas e.g., an array antenna
  • peripheral devices e.g., a bus, a general purpose input and output (GPIO), a serial peripheral interface (SPI), or a mobile industry processor interface (MIPI)
  • GPIO general purpose input and output
  • SPI serial peripheral interface
  • MIPI mobile industry processor interface
  • commands or data may be transmitted or received between the electronic device (101) and an external electronic device (104) via a server (108) connected to a second network (199).
  • Each of the external electronic devices (102, or 104) may be the same or a different type of device as the electronic device (101).
  • all or part of the operations executed in the electronic device (101) may be executed in one or more of the external electronic devices (102, 104, or 108). For example, when the electronic device (101) is to perform a certain function or service automatically or in response to a request from a user or another device, the electronic device (101) may, instead of executing the function or service itself or in addition, request one or more external electronic devices to perform at least a part of the function or service.
  • One or more external electronic devices that have received the request may execute at least a part of the requested function or service, or an additional function or service related to the request, and transmit the result of the execution to the electronic device (101).
  • the electronic device (101) may process the result as it is or additionally and provide it as at least a part of a response to the request.
  • cloud computing, distributed computing, mobile edge computing (MEC), or client-server computing technology may be used.
  • the electronic device (101) may provide an ultra-low latency service by using, for example, distributed computing or mobile edge computing.
  • the external electronic device (104) may include an IoT (Internet of Things) device.
  • the server (108) may be an intelligent server using machine learning and/or a neural network.
  • the external electronic device (104) or the server (108) may be included in the second network (199).
  • the electronic device (101) can be applied to intelligent services (e.g., smart home, smart city, smart car, or healthcare) based on 5G communication technology and IoT-related technology.
  • FIG. 2 is a block diagram of a program module according to various embodiments.
  • the program (140) may include an operating system (142), middleware (144), or an application (146) executable on the operating system (142) for controlling one or more resources of the electronic device (101).
  • the operating system (142) may include, for example, Android TM , iOS TM , Windows TM , Symbian TM , Tizen TM , or Bada TM .
  • At least some of the programs (140) may be preloaded onto the electronic device (101), for example, at the time of manufacturing, or may be downloaded or updated from an external electronic device (e.g., the electronic device (102 or 104), or a server (108)) in the user's usage environment.
  • the operating system (142) may control (e.g., allocate or reclaim) system resources (e.g., processes, memory, or power) of the electronic device (101).
  • the operating system (142) may additionally or alternatively include one or more driver programs for driving other hardware devices of the electronic device (101), such as an input device (150), an audio output device (155), a display device (160), an audio module (170), a sensor module (176), an interface (177), a haptic module (179), a camera module (180), a power management module (188), a battery (189), a communication module (190), a subscriber identification module (196), or an antenna module (197).
  • driver programs for driving other hardware devices of the electronic device (101), such as an input device (150), an audio output device (155), a display device (160), an audio module (170), a sensor module (176), an interface (177), a haptic module (179), a camera module (180), a power management module (188), a battery (189), a communication
  • the middleware (144) can provide various functions to the application (146) so that the application (146) can use functions or information provided by one or more resources of the electronic device (101).
  • the middleware (144) can include, for example, an application manager (201), a window manager (203), a multimedia manager (205), a resource manager (207), a power manager (209), a database manager (211), a package manager (213), a connectivity manager (215), a notification manager (217), a location manager (219), a graphics manager (221), a security manager (223), a call manager (225), or a voice recognition manager (227).
  • the application manager (201) can manage, for example, the life cycle of the application (146).
  • the window manager (203) can manage, for example, GUI resources used on a screen.
  • the multimedia manager (205) can, for example, identify a format required for playing media files and perform encoding or decoding of the media files using a codec suitable for the format.
  • the resource manager (207) can, for example, manage the source code of the application (146) or the space of the memory.
  • the power manager (209) can, for example, manage the capacity, temperature, or power of the battery and determine or provide power information required for the operation of the electronic device (101) using the corresponding information.
  • the power manager (209) can be linked with a basic input/output system (BIOS).
  • BIOS basic input/output system
  • the database manager (211) can, for example, create, search, or modify a database to be used in the application (146).
  • the package manager (213) can, for example, manage the installation or update of an application distributed in the form of a package file.
  • the connectivity manager (215) can, for example, manage a wireless or wired connection between the electronic device (101) and an external electronic device.
  • the notification manager (217) can, for example, provide a function for notifying a user of an event that has occurred (e.g., a call, a message, or an alarm).
  • the location manager (219) can, for example, manage location information of the electronic device (101).
  • the graphics manager (221) can, for example, manage graphic effects to be provided to the user or a user interface related thereto.
  • the security manager (223) can, for example, provide system security or user authentication.
  • the telephony manager (225) may, for example, manage a voice call or video call function of the electronic device (101).
  • the voice recognition manager (227) may, for example, transmit a user's voice data to the server (108) and receive a command corresponding to a function to be performed in the electronic device (101) based on the voice data or text data converted based on the voice data.
  • the middleware (244) may dynamically delete some of the existing components or add new components.
  • at least a part of the middleware (144) may be included as a part of the operating system (142) or may be implemented as software separate from the operating system (142).
  • the application (146) may include, for example, a home (251), a dialer (253), an SMS/MMS (255), an IM (instant message) (257), a browser (259), a camera (261), an alarm (263), a contact (265), voice recognition (267), an email (269), a calendar (271), a media player (273), an album (275), a watch (277), a health (279) (e.g., measuring the amount of exercise or blood sugar, etc.), or an environmental information (281) (e.g., information on barometric pressure, humidity, or temperature) application.
  • the application (146) may further include an information exchange application (not shown) that can support information exchange between the electronic device (101) and an external electronic device.
  • the information exchange application may include, for example, a notification relay application for transmitting designated information (e.g., a call, a message, or an alarm) to an external electronic device, or a device management application for managing the external electronic device.
  • the notification relay application may, for example, transmit notification information corresponding to an event (e.g., reception of a mail) generated in another application (e.g., an email application (269)) of the electronic device (101) to the external electronic device, or receive notification information from the external electronic device and provide it to a user of the electronic device (101).
  • the device management application may, for example, control power (e.g., turn-on or turn-off) or a function (e.g., brightness, resolution, or focus of the display device (160) or the camera module (180)) of the external electronic device or a component thereof (e.g., the display device (160) or the camera module (180)) that communicates with the electronic device (101).
  • control power e.g., turn-on or turn-off
  • a function e.g., brightness, resolution, or focus of the display device (160) or the camera module (180) of the external electronic device or a component thereof (e.g., the display device (160) or the camera module (180)) that communicates with the electronic device (101).
  • the device management application may additionally or alternatively support installation, deletion, or updating of applications running on external electronic devices.
  • FIG. 3 is a schematic diagram illustrating a server device and a plurality of electronic devices according to one embodiment.
  • a server device (400) can be connected to a plurality of electronic devices (300) via a network.
  • the electronic device (300) can be a device such as a smart phone, a tablet PC, or a laptop PC, and there is no limitation on the type thereof.
  • the electronic device (300) can include at least some of the configurations and/or functions of the electronic device (101) of FIG. 1.
  • the electronic device (300) can install and execute various applications.
  • the electronic device (300) can execute at least some of the applications (146) of FIG. 2, and can also execute at least one application downloaded and installed through an application store (e.g., Play Store TM ).
  • the electronic device (300) can execute multiple applications simultaneously in the foreground and background.
  • the executed application may use resources (or system resources) of the electronic device (300).
  • the resources of the electronic device (300) used by the application may include, but are not limited to, a central processing unit (CPU), memory, input/output (I/O), threads, popup windows, virtual displays, notifications, and pending intents.
  • the types of resources used may vary depending on the executed application, and even for the same application, the types of resources used may vary depending on the operating status and/or environmental settings.
  • an application running on an electronic device (300) excessively uses a specific resource, abnormal operation may occur.
  • Applications uploaded to an application store do not guarantee performance and stability, and some applications may cause abnormal operation by excessively using some resources.
  • an application that operates well on most electronic devices (300) may cause abnormal operation on some electronic devices (300).
  • the server device (400) may receive resource usage information from a plurality of electronic devices (300), accumulate and store the received resource usage information in a resource usage data set, and calculate an outlier threshold value based on the accumulated and stored resource usage data set. For example, when the electronic device (300) executes a specific application, it may use at least one resource, and may map and store the usage of the executed application and the at least one resource used. The electronic device (300) may transmit the resource usage information to the server device (400) whenever the application uses a resource and/or when receiving a request from the server device (400).
  • the server device (400) may calculate an outlier threshold value by using statistical analysis on a resource usage data set including resource usage information of multiple electronic devices (300).
  • the server device (400) may determine an outlier threshold value for each application and each resource.
  • the outlier threshold value may be determined for each of CPU usage, memory usage, and number of pending intents generated of an SNS application by using statistical analysis.
  • the server device (400) may use IQR (inter quartile range) and/or standard deviation to set a value having a large error compared to general usage as an outlier threshold value.
  • the server device (400) can provide the calculated outlier threshold value to each electronic device (300).
  • the electronic device (300) can update the pre-stored outlier threshold value with the outlier threshold value received from the server device (400).
  • the electronic device (300) can check the usage of at least one resource and check whether the usage of each resource is equal to or greater than the outlier threshold value of each resource. For example, when an SNS application is executed, the CPU usage can be compared with the outlier threshold value of the CPU usage, the memory usage can be compared with the outlier threshold value of the memory usage, and the number of pending intents created can be compared with the outlier threshold value of the number of pending intents created.
  • the electronic device (300) may determine that an abnormal operation has occurred due to the execution of the application if the usage of a specific resource used when executing the application is greater than an abnormal threshold value. If the electronic device (300) determines that an abnormal operation has occurred, the electronic device (300) may provide feedback to the user, forcefully terminate the application, and/or delete the application.
  • the operation of determining an outlier threshold value may be performed by each electronic device (300) rather than the server device (400).
  • the electronic device (300) may store a resource usage data set in memory, and when each application is executed, record resource usage information in the resource usage data set. When sufficient data is collected in the resource usage data set, and/or at set intervals, the electronic device (300) may determine an outlier threshold value for each resource of each application through statistical analysis.
  • a server device (400) determines an outlier threshold value may be referred to as a first embodiment
  • an embodiment in which each electronic device (300) determines an outlier threshold value may be referred to as a second embodiment.
  • the first embodiment will be described with reference to FIGS. 4 to 10
  • the second embodiment will be described with reference to FIGS. 11 to 13.
  • any content that is redundant or can be inferred from the content of other embodiments may be omitted from the description.
  • FIG. 4 is a block diagram of a server device according to one embodiment.
  • the server device (400) may include a communication interface (430), a processor (410), and a memory (420). Even if some of the illustrated configurations are omitted or replaced, various embodiments of the present document may be implemented.
  • the communication interface (430) can support communication with various electronic devices (e.g., the electronic device (300) of FIG. 3) through a network.
  • the communication interface (430) can provide various interfaces such as HTTP (hypertext transfer protocol), REST (representational state transfer), MQTT (message queuing telemetry transport), and socket.
  • the server device (400) can request transmission of resource usage information to the electronic device through the communication interface (430) and receive resource usage information from the electronic device.
  • the memory (420) can temporarily or non-temporarily store various data.
  • the memory (420) can include various types of memories, such as random access memory (RAM), virtual memory, cache memory, and/or flash memory.
  • RAM random access memory
  • the memory (420) can store various instructions that can be executed by the server device (400) (or processor (410)).
  • the memory (420) can store a resource usage data set that accumulates and stores resource usage information received from a plurality of electronic devices.
  • the resource usage data set can store usage information of each application and each resource by mapping them.
  • the resource usage data set includes a RAW_DATA set that accumulates and stores RAW_DATA of resource usage received from the electronic devices, and additionally, can further include a COUNT set, a SUM set, a SQUARE_SUM set, and a FREQUENCY_TABLE set that accumulates and stores data such as COUNT, SUM, SQUARE_SUM, and FREQUENCY_TABLE related to resource usage.
  • the processor (410) is a configuration capable of performing operations or data processing related to control and/or communication of each component of the server device (400), and may be configured with one or more processors.
  • the operations of the processor (410) (or the server device (400)) described below may be performed by executing instructions stored in the memory (420).
  • the processor (410) may execute various server processes or threads to perform operations of storing resource usage information received from an electronic device in a resource usage data set and generating an outlier threshold value from data stored in the resource usage data set.
  • the processor (410) may request transmission of resource usage information to an electronic device via the communication interface (430). For example, the processor (410) may request transmission of resource usage information to each electronic device at set intervals or based on the amount of data accumulated in the resource usage data set.
  • the processor (410) when it receives resource usage information from an electronic device through a communication interface (430), it may store the same in a resource usage data set of the memory (420).
  • the structure of data accumulated and stored in the resource usage data set will be described in more detail with reference to FIG. 6.
  • the processor (410) may determine at least one outlier threshold corresponding to each of a specific application and at least one resource used when executing the specific application based on a resource usage data set through a predetermined statistical analysis.
  • the processor (410) may perform an operation of determining an outlier threshold corresponding to each of the resources for each of a plurality of applications.
  • an outlier threshold for resource 0 of App 0 an outlier threshold for resource 1 , ..., an outlier threshold for resource j
  • an outlier threshold for resource 0 of App 1 , an outlier threshold for resource 1 , ..., an outlier threshold for resource j may be calculated, and an outlier threshold for resource 0 of App 1 , an outlier threshold for resource 1 , ..., an outlier threshold for resource j may be calculated.
  • the processor (410) can verify normality for data of a specific application and a specific resource of the resource usage data set.
  • the normality verification can be based on, but is not limited to, the Kolmogorov-Smirnov test, the Shapiro-Wilk test, and/or the skewness, kurtosis, and standard error tests.
  • the processor (410) may calculate the average and standard deviation of the data of the resource usage data set of a specific resource if the data follows a normal distribution.
  • the processor (410) may determine an outlier threshold based on the standard deviation and a predetermined weight (e.g., w 1 ) for the corresponding resource.
  • a predetermined weight e.g., w 1
  • the processor (410) may determine the outlier threshold as a product of the standard deviation and the weight.
  • the weight w 1 may be determined as a different value for each resource.
  • the processor (410) may calculate an inter quartile range (IQR) when data of a resource usage data set of a specific resource does not follow a normal distribution, and determine an outlier threshold based on the IQR and a predetermined weight for the resource.
  • the IQR may be determined as the difference between data corresponding to the lower 25% and data corresponding to the upper 25% after sequentially (e.g., in ascending order) sorting each data according to its value.
  • the processor (410) may obtain the Q3 value and the Q1 value, and then obtain the IQR as the difference therebetween.
  • the processor (410) may determine a value obtained by multiplying the IQR by a weight (e.g., w 2 ) and adding the value obtained by the Q3 value as the outlier threshold.
  • a weight e.g., w 2
  • the weight w 2 may be determined as a different value for each resource.
  • the processor (410) may also calculate an outlier threshold based on the IQR and the weight w 2 for all data, without verifying normality of the data.
  • the processor (410) can transmit the calculated abnormality threshold value to each electronic device through the communication interface (430).
  • the electronic device can store the received abnormality threshold value and compare the usage of each resource used when executing the application with each abnormality threshold value to determine whether an abnormal operation has occurred.
  • FIG. 5 is a block diagram of a process running on a server device and an electronic device according to one embodiment.
  • a server process (450) running on a server device includes an outlier threshold calculator (470), and the outlier threshold calculator (470) can access a resource usage data set (460) stored in a memory of the server device (e.g., memory (420) of FIG. 4).
  • an electronic device process (350) running on an electronic device may include a resource generator (360) and a resource manager daemon (370).
  • the resource generator (360) may generate an event corresponding to the resource usage of the application when the application is executed and uses at least one resource, and transmit the event to the resource manager daemon (370).
  • the resource generator (360) may be provided in the form of a class (e.g., ResEvt.class(.java))(361), a JNI (java native interface) library (e.g., ResEvt JNI library(.cpp))(362), and/or a SO (shared object) (e.g., LibresEvt.so)(363).
  • the resource generator (360) may be executed as a part of a system process, and may generate an event indicating that a resource is being used by the system process through a plug-in, and transmit the event to the resource manager daemon (370).
  • the resource manager daemon (370) can record resource usage statistics (371) and manage an outlier threshold value (372).
  • the resource manager daemon (370) can receive application and resource usage information from the resource generator (360) and record the same in the resource usage statistics (371).
  • the resource usage statistics (371) can store usage information of multiple applications and each resource used by each application in the form of a table.
  • the resource manager daemon (370) when the resource manager daemon (370) receives an event from the resource generator (360), it may compare the usage of each resource with an outlier threshold value corresponding to each resource. If, as a result of the comparison, it is confirmed that the application of the corresponding event has used a specific resource more than the outlier threshold value, the resource manager daemon (370) may determine that the corresponding application is operating abnormally due to excessive use of resources. In this case, the resource manager daemon (370) may not record the usage information of each resource included in the corresponding event in the resource usage statistics (371).
  • the resource manager daemon (370) may transmit resource usage statistics (371) accumulated in resource usage statistics to the server device whenever there is a data transmission request from the server device and/or whenever a resource usage event of an application is transmitted.
  • the resource manager daemon (370) can stop the operation of the application (or terminate the execution) and reclaim the resources. After stopping the operation of the application, the resource manager daemon (370) can provide a notification to the user through an output device (e.g., a display, a speaker, a haptic) indicating the abnormal operation and induce the user to restart the application. If the problem of excessive resource usage occurs repeatedly more than a certain number of times even after the application is restarted, the resource manager daemon (370) can provide a user interface through the output device to induce the user to delete the application.
  • an output device e.g., a display, a speaker, a haptic
  • the resource manager daemon (370) may store an outlier threshold value received from a server device and update a pre-stored outlier threshold value (372) when a new outlier threshold value is received from the server device.
  • the server device may store the resource usage data set (460).
  • the resource usage data set (460) may accumulate and store resource usage information obtained from multiple electronic devices, and may map and store usage information of each application and each resource.
  • the outlier threshold calculator (470) may determine at least one outlier threshold corresponding to each of a specific application and at least one resource used when executing the specific application based on the resource usage data set (460) through a predetermined statistical analysis.
  • the outlier threshold calculator (470) may perform an operation of determining an outlier threshold corresponding to each of the resources for each of a plurality of applications.
  • an outlier threshold for resource 0 of App 0 , an outlier threshold for resource 1 , ..., an outlier threshold for resource j may be calculated, and an outlier threshold for resource 0 of App 1 , an outlier threshold for resource 1 , ..., an outlier threshold for resource j may be calculated.
  • the outlier threshold calculator (470) can test the normality of the usage data of a specific resource of a specific application to determine whether it follows a normal distribution. If the data follows a normal distribution, the outlier threshold calculator (470) can calculate a standard deviation and calculate an outlier threshold based on the standard deviation and a predetermined weight. If the data does not follow a normal distribution, the outlier threshold calculator (470) can calculate an inter quartile range (IQR) and calculate an outlier threshold based on the IQR and a predetermined weight.
  • IQR inter quartile range
  • FIG. 6 illustrates a resource usage data set according to one embodiment.
  • the server device can accumulate and store resource usage information received from multiple electronic devices in a resource usage data set (460).
  • FIG. 6 illustrates a data structure of a resource usage data set (460) for collecting usage statistics of resources used by applications running on each electronic device.
  • each row of the resource usage data set (460) represents a plurality of applications that can be executed on the electronic device, and each column can represent a resource that can be used by each application.
  • the applications can include applications provided in an application store, such as SNS applications, multimedia applications, or game applications, and the resources can be system resources that can be used when the applications are executed, such as CPU (central processing unit) usage, memory usage, I/O usage, number of threads created, number of pop-up windows created, number of virtual displays created, number of notification occurrences, and number of pending intents created. Examples of the applications and resources are not limited to the above examples.
  • resource usage data (465) mapped and stored for a specific resource (e.g., resource 1) of a specific application (e.g., App5) is illustrated in more detail.
  • the resource usage data of App5 and resource 1 may be accumulated and recorded by obtaining the usage of resource 1 when App5 is executed on a specific electronic device.
  • Resource usage data (465) recorded for a specific application and a specific resource may include SUM, COUNT, SQUARE_SUM, FREQUENCY_TABLE, RAW_DATA.
  • x k is the size of the resource used by the application, and N can be the number of times the application requested the resource or the number of samples.
  • RAW_DATA can be a set of x k
  • FREQUENCY_TABLE can be a data structure that stores the class (or interval) of x k and the frequency by class.
  • COUNT, SUM, and SQUARE_SUM can be calculated as shown in Equations 1, 2, and 3 below.
  • COUNT is equal to N
  • SUM can be calculated as the sum of the sizes of the resources used by the application.
  • SQUARE_SUM can be calculated as the sum of the squares of the sizes of the resources used by the application.
  • the server device may accumulate data received from multiple electronic devices for a specific application and a specific resource and store the data in a resource usage data set (460). For example, the server device may calculate COUNT set, SUM set, SQUARE_SUM set, and FREQUENCY_TABLE set, respectively, by adding up the COUNT, SUM, SQUARE_SUM, and FREQUENCY_TABLE values related to resource usage of k electronic devices, as shown in Equations 4 to 7 below.
  • the SUM set can be calculated as the sum of the sizes of the resources used by the applications running on the k electronic devices.
  • the SQUARE_SUM set can be calculated as the sum of the squares of the sizes of the resources used by the corresponding applications on each of the k electronic devices.
  • the frequency of the ith class (or interval) of the FREQUENCY_TABLE set can be calculated as the sum of the frequencies of the resource usage belonging to the corresponding class on each of the k electronic devices.
  • the RAW_DATA set is for a normality test in the server process, and can be the sum of RAW_DATA, which is data that samples all or part of the resource usage information used by the applications installed on each electronic device.
  • Table 1 shows a set of resource usage information collected from multiple electronic devices for App5 (e.g., SNS application) and Resource1 (e.g., pending intent).
  • App5 e.g., SNS application
  • Resource1 e.g., pending intent
  • the server device When the server device receives resource usage information as in Table 1, it can add up the resource usage information of each electronic device as in Table 2 below.
  • the server device can store the summed COUNT set, SUM set, SQUARE_SUM set, RAW_DATA set, and FREQUENCY_TABLE set in the resource usage data set (460) as shown in Table 2.
  • each electronic device can transmit only resource usage information (e.g., RAW_DATA) for specific resources used by specific applications to the server device, in which case the server device can calculate data such as COUNT, SUM, SQUARE_SUM, and FREQUENCY TABLE of the electronic device based on the received RAW_DATA.
  • each electronic device can obtain resource usage information for specific resources used by specific applications, and then calculate data such as COUNT, SUM, SQUARE_SUM, and FREQUENCY TABLE and transmit the calculated data to the server device.
  • FIG. 7 is a block diagram of a process running on a server device and an electronic device according to one embodiment.
  • the resource usage data set (460) in the server process (450) can accumulate and store resource usage information received from various electronic devices.
  • the resource usage data set (460) stored in the server device has been described in detail with reference to FIG. 6.
  • the server process (450) may determine at least one outlier threshold value corresponding to each of a specific application and at least one resource used by the specific application when executing, based on a resource usage data set (460) stored in a memory (e.g., memory (420) of FIG. 4) through a predetermined statistical analysis.
  • the outlier threshold calculator (460) can perform a normality test (472) on at least some of the resource usage information stored in the resource usage data set (460) to determine whether the corresponding resource usage information is normal. If the resource usage information is normal, the outlier threshold calculator (460) can calculate a standard deviation and determine an outlier threshold based on the mean, the standard deviation, and a predetermined weight for the corresponding resource for each resource usage information (473). In addition, if the resource usage information is not normal, the outlier threshold calculator (460) can calculate an inter quartile range (IQR) and determine an outlier threshold based on the IQR and a predetermined weight for the corresponding resource for each resource (474).
  • IQR inter quartile range
  • the outlier threshold calculator (460) may collect resource usage statistics (371) of each application transmitted from the resource manager daemon (370) of the electronic device, and accumulate and store them in a resource usage data set (460).
  • the server device may request the electronic device to transmit resource usage information according to a set cycle, or the electronic device may transmit resource usage information to the server device whenever a resource usage event occurs due to execution of the application.
  • the outlier threshold calculator (460) may obtain statistical values by using statistical information (e.g., SUM set, COUNT set, SQUARE_SUM set, FREQUNCY_TABLE set) of specific resources used by specific applications collected from multiple electronic devices, and may test normality (472).
  • the normality test may be based on, but is not limited to, the Kolmogorov-Smirnov test, the Shapiro-Wilk test, and/or the skewness, kurtosis, and standard error tests.
  • the outlier threshold calculator (460) can calculate the standard deviation if the data has normality. For example, if the 29 numbers included in RAW_DATA of Table 2 have normality, the average and standard deviation of the 29 numbers can be calculated.
  • the outlier threshold calculator (460) can determine an outlier threshold based on the calculated standard deviation (SD) and a predetermined weight (w 1 ) for the corresponding resource. For example, if the resource usage information has normality, the outlier threshold can be calculated as in Equation 8 below.
  • AVG SUM set / COUNT set
  • Outlier threshold AVG + SD * w 1
  • AVG is the average of each resource usage recorded in the resource usage data set, which can be calculated by dividing the COUNT set by the recorded SUM set.
  • the weight w 1 can be determined as a different value for each resource.
  • the weight threshold calculator (460) may calculate an inter quartile range (IQR) if the data has normality.
  • IQR inter quartile range
  • the IQR may be determined as the difference between the data corresponding to the lower 25% and the data corresponding to the upper 25% after sorting each data sequentially (e.g., in ascending order) according to its value.
  • Table 3 shows the frequency distribution of the FREQUENCY_TABLE set for a specific resource usage of a specific application.
  • the Q1 index corresponding to the order of the lower 25% of data and the Q3 index corresponding to the order of the upper 25% of data can be calculated as in Equations 9 and 10 below.
  • the Q1 value corresponding to the values of the lower 25% of data and the Q3 value corresponding to the values of the upper 25% of data can be calculated as in the following equation 11.
  • the Q1 value and the Q3 value can be obtained by listing 29 data in ascending order and then finding the 7th and 22nd data.
  • the resource usage data set (460) obtained from an actual server device includes a large amount of data, listing all data in ascending order and finding data corresponding to each order may be inefficient in terms of computation time.
  • the server device can find a class (or section) to which the Q1 index and the Q3 index belong by a method such as Equation 11, and infer the order of the Q1 index and the Q3 index in the corresponding class by interpolation, thereby calculating the Q1 value and the Q3 value.
  • the outlier threshold calculator (460) can calculate the outlier threshold based on the IQR and a predetermined weight (w 2 ) for the corresponding resource.
  • Equation 12 is a formula for calculating the outlier threshold based on the IQR.
  • Outlier threshold Q3 + (Q3-Q1) * w 2
  • the outlier threshold can be calculated as in Equation 13 below.
  • the weight w 2 is substituted as 1.5, but is not limited thereto.
  • the outlier threshold calculator (460) determines the method for calculating the outlier threshold differently depending on whether the data of the resource usage data set (460) has normality. According to another embodiment, the outlier threshold calculator (460) may calculate the outlier threshold based on the IQR for all data without performing a normality test.
  • the outlier threshold calculator (460) can calculate an outlier threshold for each application and each corresponding resource in the resource usage data set (460). For example, as illustrated in FIG. 7, if the usage of applications A 0 to A i and the resource usage of resources R 0 to R j are recorded in the resource usage data set (460), the outlier threshold calculator (460) can calculate an outlier threshold TH ij corresponding to the application A i and the resource R j for each application and resource. In this case, some applications may not use some of the resources, in which case the outlier threshold calculator (460) can exclude the outlier threshold corresponding to the corresponding application and resource, or record it as a value less than or equal to 0 (e.g., -1).
  • FIGS. 8A to 8D illustrate UIs provided when abnormal operation due to excessive use of resources is detected in an electronic device according to one embodiment.
  • the electronic device (300) may check the usage of at least one resource used by the executed application, and if the usage of a specific resource is greater than an outlier threshold set for the application and resource, the electronic device may determine that an abnormal operation has occurred due to the executed application.
  • the electronic device (300) when an abnormal operation occurs, can terminate the execution of an application that has excessively used resources.
  • the electronic device (300) can provide a notification including information indicating an application in which an abnormal operation has occurred and information indicating at least one resource that has been used exceeding a threshold value through an output device.
  • the notification can include at least one of a user interface visually provided on a display, vibration using haptics, and audio information using a speaker.
  • Figures 8a to 8d illustrate a UI provided through a display when abnormal motion is detected.
  • the electronic device (300) may display a UI indicating the abnormal operation on the display.
  • the electronic device (300) may display the UI indicating the abnormal operation as a UI (810) in the form of a pop-up in the central area of the screen as illustrated in FIG. 8A, and/or may provide it through a UI (820) on a status bar provided at the top of the screen as illustrated in FIG. 8B.
  • the electronic device (300) may forcibly terminate the application that has caused the abnormal operation and provide a UI (810, 820) such as FIG. 8A or FIG. 8B through the display at least partially at the same time.
  • the electronic device (300) can provide information indicating overused resources such as that shown in FIG. 8c through the UI (830).
  • the electronic device (300) may provide information on resources (e.g., pending intent, popup window, virtual display) used by an executed application, and may provide a resource (e.g., pending intent) used above an abnormal threshold value so that the user can recognize it.
  • resources e.g., pending intent, popup window, virtual display
  • a resource e.g., pending intent
  • the electronic device (300) may provide feedback to the user when the number of times a specific application is terminated due to an abnormal operation occurring during execution of the application is greater than or equal to a reference number (e.g., 3 times).
  • the feedback may include information that induces deletion of the application.
  • the electronic device (300) may provide a UI (840) through which the user can select whether to delete the application, as shown in FIG. 8d, via the display.
  • the electronic device (300) may delete the corresponding application.
  • FIGS. 9A to 9D are flowcharts of a method for an electronic device to detect abnormal operation of an application according to one embodiment of the present invention.
  • FIGS. 9A to 9D may be performed by a processor of an electronic device (e.g., processor (120) of FIG. 1), and for example, at least some of the operations illustrated may be performed by a resource generator (360) and/or a resource manager daemon (370) of FIG. 5.
  • the methods illustrated may be implemented as instructions executable by the electronic device (or the processor of the electronic device). These instructions may be stored on a computer readable recording medium.
  • Figure 9a illustrates how an electronic device obtains and updates an outlier threshold value after initializing a resource manager daemon.
  • the electronic device may initialize a resource manager daemon.
  • the resource manager daemon may record usage information of at least one resource used when executing an application, and manage an outlier threshold corresponding to each application and each resource.
  • the electronic device may set the outlier threshold to a value less than 0 (e.g., -1).
  • the reason for initializing the outlier threshold to a value less than 0 is that this is a situation before statistical outliers are obtained for information on a specific application's use of a specific resource, so that the outlier threshold may be set to a negative number so as not to determine an abnormal operation when the application is executed.
  • the electronic device may determine that it is not an abnormal operation regardless of the usage amount of the corresponding resource.
  • the electronic device may set the outlier threshold to a statistically insignificantly large value rather than a value less than 0 during the initialization process of the resource manager daemon.
  • the electronic device can determine whether an outlier threshold value is received from the server device.
  • the server device can calculate an outlier threshold value corresponding to each application and each resource through statistical analysis based on resource usage information acquired from various electronic devices.
  • the server device can calculate an outlier threshold value when sufficient data is accumulated in the resource usage data set, and can provide the calculated outlier threshold value to each electronic device.
  • the electronic device may update a pre-stored outlier threshold value with the outlier threshold value transmitted from the server device. For example, during the initialization process of the resource manager daemon, the outlier threshold value set to a value less than 0 (e.g., -1) may be updated with the outlier threshold value acquired from the server device. Thereafter, when an application is executed and uses at least one resource, the electronic device may check whether the usage of each resource is greater than or equal to the updated outlier threshold value.
  • FIG. 9b illustrates a method for an electronic device to transmit resource usage information to a server device and initialize previously stored data.
  • the electronic device may receive a data transmission request from a server device.
  • the electronic device may transmit resource usage information recorded in the memory to the server device. For example, in response to a data transmission request from the server device, the electronic device may transmit COUNT, SUM, SQUARE_SUM, FREQUENCY_TABLE, and RAW_DATA related to each resource usage of each application recorded in the memory to the server device. COUNT, SUM, SQUARE_SUM, FREQUENCY_TABLE, and RAW_DATA included in the resource usage information have been described above with reference to FIG. 6.
  • the electronic device may record only RAW_DATA in the memory and then transmit it to the server device, in which case the server device may calculate data such as COUNT, SUM, SQUARE_SUM, and FREQUENCY TABLE of the corresponding electronic device based on the received RAW_DATA.
  • the electronic device may initialize the values of COUNT, SUM, and SQUARE_SUM recorded in the memory to 0. Additionally, in operation 928, the electronic device may initialize FREQUENCY_TABLE and RAW_DATA. After transmitting the resource usage information to the server device, the electronic device may initialize the recorded data.
  • the electronic device After the electronic device initializes the resource usage information, when a resource usage event occurs due to the execution of the application, the usage information of the used resources can be recorded in the memory.
  • Figure 9c illustrates how an electronic device records resource usage information into memory.
  • the electronic device may receive an event for specific resource usage of a specific application. For example, when the application is executed, it may use at least one resource (e.g., CPU usage, memory usage, pending intent generation), and a resource generator (e.g., resource generator (360) of FIG. 5) may forward an event for each resource usage of the application to a resource manager daemon (e.g., resource manager daemon (370) of FIG. 5).
  • the electronic device may store the specific resource usage of the specific application in a variable R.
  • the electronic device may determine whether the resource usage is less than the current outlier threshold, or whether the outlier threshold is a value less than 0.
  • the electronic device may set the outlier threshold to a value less than 0 (e.g., -1) during the initialization process of the resource manager daemon, and if the outlier threshold is a value less than 0, it may be the case that there is no outlier threshold value acquired from the server device.
  • the electronic device may determine that an abnormal operation has occurred due to excessive resource usage according to the execution of the application. In this case, in response to the occurrence of the abnormal operation, the electronic device may terminate the application and/or output a notification for notifying the abnormal operation through an output device (e.g., a display, a haptic, a speaker). In addition, if the amount of resource usage according to the currently set abnormality threshold is greater than or equal to the currently set abnormality threshold, the electronic device may not perform an operation of recording resource usage information of operation 948 or less.
  • an output device e.g., a display, a haptic, a speaker
  • an operation of recording resource usage information of operation 948 or lower may be performed.
  • the electronic device may add 1 to COUNT, which is a value currently stored in memory for a specific application and a specific resource, add R to SUM, and add R*R to SQUARE_SUN.
  • R is the usage amount of the application executed in operation 942, and therefore, resource usage information of the corresponding application may be recorded in the memory according to operation 948.
  • the electronic device may determine whether storage of the current data is required. For example, if a sufficient number of pieces of information related to the specific resource usage of the application executed at operation 942 are already stored in the memory, the electronic device may determine that storage of additional data is unnecessary. Alternatively, the electronic device may determine whether storage of the current data is required based on whether an outlier threshold value corresponding to the corresponding application and/or the corresponding resource is provided from a server device.
  • the electronic device may store the current data in RAW_DATA.
  • the electronic device may increase the number of a class including the current resource usage (or R value) in the FREQEUNCY_TABLE by 1.
  • the numerical range of the resource usage may be divided into a plurality of classes, and the electronic device may increase the number of a class to which the resource usage acquired in operation 942 belongs among the plurality of classes by 1.
  • the size of the plurality of classes related to the usage of each resource may be arbitrarily determined for each type of resource, or may be specified by the server device.
  • the electronic device may define a class as a string value of a class including an R value. If there is no value for the corresponding class in FREQUENCY_TABLE, the electronic device may set the frequency of the corresponding class to 0. If there is a value for the corresponding class in FREQUENCY_TABLE, the electronic device may increase the frequency of the corresponding class by 1.
  • Figure 9d illustrates the operation of an electronic device when an abnormal operation occurs depending on the execution of a specific application.
  • the electronic device may receive an event regarding usage of a particular resource by a particular application.
  • the electronic device may determine whether the resource usage is greater than or equal to a current outlier threshold value, and whether the outlier threshold value is greater than or equal to 0. If the outlier threshold value is greater than or equal to 0, it may mean that the outlier threshold value is set to an outlier threshold value obtained from a server device.
  • the electronic device may determine that the operation is not abnormal and record the resource usage in memory. For example, the electronic device may perform an operation of recording resource usage information of operation 948 or lower of FIG. 9c.
  • the electronic device may determine that the abnormal operation is due to excessive resource usage.
  • the electronic device may, in operation 968, forcefully terminate the application that caused the abnormal operation.
  • the electronic device can determine whether the number of times the application has been force-terminated is greater than or equal to a reference number.
  • the reference number may be three, but is not limited thereto.
  • the electronic device may provide a UI indicating an abnormal operation of the application through the display.
  • the electronic device may provide the UI indicating the abnormal operation in the form of a pop-up as in FIG. 8A, and/or on a status bar as in FIG. 8B.
  • the electronic device may provide a notification indicating the abnormal operation of the application through another type of output device (e.g., haptic, speaker) other than the display.
  • the electronic device may provide a UI that induces the user to delete the application. For example, the electronic device may provide the UI of FIG. 9d through the display. According to one embodiment, if the user selects a predetermined button on the UI provided in operation 974, the electronic device may provide a UI that induces the deletion of the application in operation 972.
  • FIG. 10 is a flowchart of a method for determining an abnormality threshold value of a server device according to one embodiment.
  • the method illustrated in FIG. 10 can be performed by a processor of a server device (e.g., processor (410) of FIG. 4), and the technical features described above may be omitted from the description below.
  • the method illustrated can be implemented by instructions that can be executed by a server device (e.g., processor (410) of server device (400)). These instructions can be stored on a computer readable recording medium.
  • the server device may receive resource usage information including the usage of at least one resource used when executing a specific application from the electronic device.
  • the server device may receive COUNT, SUM, SQUARE_SUM, FREQUENCY_TABLE, and RAW_DATA corresponding to the specific application and the specific resource.
  • COUNT is the number of times the application requested the resource or the number of samples
  • RAW_DATA is a set of acquired resource usages
  • SUM is the sum of the sizes of the resources used by the corresponding application
  • SQUARE_SUM is the sum of the squares of the sizes of the resources used by the corresponding application.
  • the server device may receive only RAW_DATA from the electronic device, and in this case, the server device may calculate other data such as COUNT, SUM, SQUARE_SUM, and FREQUENCY_TABLE based on the RAW_DATA received.
  • the server device may add resource usage information received from the electronic device to a resource usage data set stored in a memory.
  • the server device may add COUNT, SUM, and SQUARE_SUM received from the electronic device to the COUNT set, SUM set, and SQUARE_SUM set of the resource usage data set, respectively.
  • the server device may add RAW_DATA received from the electronic device to the RAW_DATA set.
  • the resource usage data set accumulated and stored by the server device has been described in detail with reference to FIG. 6.
  • the server device can update the FREQUENCY_TABLE set based on the FREQUENCY_TABLE received from the electronic device. For example, the server device can determine the class as a string value of a first rank of the FREQUENCY_TABLE, and if the corresponding class exists in the received FREQUENCY_TABLE, the server device can add the frequency value of the corresponding class in the received FREQUENCY_TABLE to the frequency value of the corresponding class in the FREQUENCY_TABLE set.
  • the server device can determine the class as a string value of a next rank, and repeat the operation of adding the frequency value of the corresponding class in the received FREQUENCY_TABLE to the frequency value of the corresponding class in the FREQUENCY_TABLE set as described above until there are no more classes to be added.
  • the server device can perform a normality test on the feature applications and resource usage of the resource usage data set.
  • the normality test can be based on, but is not limited to, a Kolmogorov-Smirnov test, a Shapiro-Wilk test, and/or a skewness, kurtosis, and standard error test.
  • the server device can verify whether the normality test result data follows a normal distribution. If the data follows a normal distribution, operations 1052 and 1054 can be performed, and if the data does not follow a normal distribution, operations 1042, 1044, and 1046 can be performed.
  • the server device may calculate a standard deviation of each data included in the resource usage data set of the corresponding application and resource.
  • the standard deviation may be calculated as in Equation 14.
  • the server device may calculate an outlier threshold based on the calculated standard deviation and a predetermined weight (w 1 ) for the corresponding resource.
  • the outlier threshold may be calculated as in Equation 15.
  • AVG SUM set / COUNT set
  • Outlier threshold AVG + SD * w 1
  • AVG is the average of each resource usage recorded in the resource usage data set, which can be calculated by dividing the COUNT set by the recorded SUM set.
  • the weight w 1 can be determined as a different value for each resource.
  • the server device may calculate a Q1 index and a Q3 index.
  • the Q1 index may correspond to a sequence of the lower 25% of data after sorting the data in ascending order
  • the Q3 index may correspond to a sequence of the upper 25% of data.
  • the Q1 index and the Q3 index may be calculated according to Equations 16 and 17, respectively.
  • the server device can calculate an inter quartile range (IQR).
  • the IQR can be determined as a difference between the Q3 value and the Q1 value.
  • the server device can check the Q3 value of the Q3 index and the Q1 value of the Q1 index, and calculate the IQR through the difference.
  • the server device can find a class (or section) to which the Q1 index and the Q3 index belong, and infer an order of the Q1 index and the Q3 index in the corresponding class by interpolation, and calculate the Q1 value and the Q3 value.
  • the server device may calculate an outlier threshold based on the calculated IQR and a predetermined weight (e.g., w 2 ).
  • the outlier threshold may be calculated as in Equation 18.
  • Outlier threshold Q3 + (Q3-Q1) * w 2
  • the weight w2 can vary for each resource.
  • the server device can transmit the determined abnormality threshold value to each electronic device.
  • the electronic device can store the received abnormality threshold value and compare the usage of each resource used when executing the application with each abnormality threshold value to determine whether an abnormal operation has occurred.
  • FIG. 11 is a block diagram of an electronic device according to one embodiment.
  • an electronic device (1100) may include a processor (1110), a memory (1120), a communication module (1130), and at least one output device (1140). Even if some of the illustrated configurations are omitted or replaced with other configurations, various embodiments of the present document may be implemented.
  • the electronic device (1100) may further include at least some of the configurations and/or functions of the electronic device (101) of FIG. 1. At least some of the respective configurations of the illustrated (or not illustrated) electronic device (1100) may be operatively, functionally, and/or electrically connected to each other.
  • the electronic device (1100) may include at least one output device (1140) for providing a visual, auditory, or tactile notification (or feedback) to a user.
  • the at least one output device (1140) may include a display (1150), a speaker (1160), and a haptic module (1170).
  • the display (1150) may be implemented as any one of a liquid crystal display (LCD), a light-emitting diode (LED) display, and an organic light-emitting diode (OLED) display, but is not limited thereto.
  • the display (1150) may be configured as a touch screen that detects a touch and/or proximity touch (or hovering) input using a part of a user's body (e.g., a finger) or an input device (e.g., a stylus pen).
  • the display (1150) may include at least some of the configurations and/or functions of the display module (160) of FIG. 1. At least a part of the display (1150) may be flexible, and may be implemented as a foldable display or a rollable display.
  • the haptic module (1170) may generate a vibration that can be perceived by a user through a mechanical structure such as a motor.
  • the haptic module (1170) may include at least some of the configuration and/or functions of the haptic module (179) of FIG. 1.
  • the speaker (1160) can output audio signals externally.
  • the speaker (1160) can include at least some of the configurations and/or functions of the audio output module (155) of FIG. 1.
  • the electronic device (1100) may further include, in addition to the display (1150), the haptic module (1170), and the speaker (1160), other types of output devices (1140) that can provide a user with a perceptible notification through various senses.
  • the communication module (1130) may include various hardware and/or software configurations to support wireless communication with an external device (e.g., server device (400) of FIG. 3).
  • the communication module (1130) may support short-range wireless communication (e.g., Wi-Fi, Bluetooth) and cellular wireless communication (e.g., 4G LTE, 5G NR).
  • the communication module (1130) may include at least some of the configurations and/or functions of the communication module (190) of FIG. 1.
  • the memory (1120) may temporarily or permanently store various data, including volatile memory and non-volatile memory.
  • the memory (1120) may include at least some of the configuration and/or functions of the memory (130) of FIG. 1, and may store at least some of the program (140) of FIG. 1 and/or the program (140) of FIG. 2.
  • the memory (1120) may store various instructions that may be performed by the processor (1110). Such instructions may include control commands such as arithmetic and logical operations, data movement, and input/output that may be recognized by the processor (1110).
  • the processor (1110) may be configured as one or more processors (1110) capable of performing calculations or data processing related to control and/or communication of each component of the electronic device (1100).
  • the processor (1110) may be electrically, functionally, and/or operatively connected to each component of the electronic device (1100) including a memory (1120), an output device (1140), and a communication module (1130).
  • the processor (1110) may include at least some of the configurations and/or functions of the processor (120) of FIG. 1.
  • the electronic device (1100) may include a multi-processor computer architecture, such as dual, quad, or octa core.
  • the electronic device (1100) may configure a processor (1110) by integrating multiple cores that perform core operations, such as computational tasks, on a single integrated circuit.
  • the processor (1110) may be implemented as a single core processor.
  • the processor (1110) can implement on the electronic device (1100), but the following describes various embodiments of checking a resource usage event when an application is executed, recording resource usage information in the memory (1120), calculating an abnormality threshold corresponding to each resource based on a resource usage data set stored in the memory (1120), and determining an abnormal operation when a specific resource usage is higher than the abnormality threshold and providing feedback corresponding to the occurrence of the abnormal operation.
  • the operations of the electronic device (1100) or the processor (1110) described below can be performed by loading instructions stored in the memory (1120).
  • the electronic device (1100) can install and execute various applications.
  • the electronic device (1100) can execute at least some of the applications (146) of FIG. 2, and can also execute at least one application downloaded and installed through an application store (e.g., Play Store TM ).
  • the electronic device (1100) can execute multiple applications simultaneously in the foreground and background.
  • the executed application may use the resources of the electronic device (1100).
  • the resources of the electronic device (1100) used by the application may include, but are not limited to, a central processing unit (CPU), memory, I/O, threads, pop-up windows, virtual displays, notifications, and pending intents.
  • the types of resources used may vary depending on the executed application, and even for the same application, the types of resources used may vary depending on the operating state and/or environment settings.
  • the memory (1120) can store a resource usage data set that maps and records a plurality of applications and a plurality of resource usages corresponding to each of the plurality of applications.
  • the resource usage data set can map and store usage information of each application and each resource.
  • the resource usage data set can store data related to resource usage, such as COUNT, SUM, SQUARE_SUM, and FREQUENCY_TABLE.
  • the resource usage data set can have the same data structure as the resource usage data set stored on the server device described in FIG. 6.
  • the processor (1110) can check the usage of at least one resource used by a specific application when the specific application is executed. For example, when a specific application is executed according to a user's input, the executed application can use at least one resource (e.g., CPU usage, memory usage, pending intent creation), and the processor (1110) can check an event related to resource usage.
  • the executed application can use at least one resource (e.g., CPU usage, memory usage, pending intent creation), and the processor (1110) can check an event related to resource usage.
  • the processor (1110) may record usage information of at least one resource used according to the execution of an application in a resource usage data set stored in the memory (1120).
  • the resource usage data set may accumulate and record usage information of each resource used when each application is executed, and the processor (1110) may add usage information of at least one resource used according to the execution of the application to data of the corresponding application and resource in the resource usage data set.
  • the processor (1110) may determine that it is an abnormal operation, and in this case, the operation of recording in the resource usage data set may not be performed.
  • the processor (1110) may determine at least one outlier threshold value (e.g., a first outlier threshold value) corresponding to each of a specific application and at least one resource used when executing the specific application, based on a resource usage data set stored in the memory (1120), through a predetermined statistical analysis.
  • the method by which the processor (1110) determines the outlier threshold value may correspond to the method of the operation of the server device determining the outlier threshold value described above through FIGS. 4 to 10.
  • the processor (1110) can perform a normality test on the feature applications and resource usage of the resource usage data set.
  • the normality test can be based on, but is not limited to, the Kolmogorov-Smirnov test, the Shapiro-Wilk test, and/or the skewness, kurtosis, and standard error tests.
  • the processor (1110) may determine an outlier threshold based on a standard deviation and a predetermined weight (w 1 ) when the data follows a normal distribution. For example, the processor (1110) may calculate an average and a standard deviation of data following a normal distribution. The processor (1110) may determine an outlier threshold as a product of the standard deviation and the weight.
  • the weight w 1 may be determined as a different value for each resource.
  • the processor (1110) may determine an outlier threshold based on the IQR and a predetermined weight (w 2 ) for the corresponding resource when the data does not follow a normal distribution.
  • the IQR may be determined as the difference between the data corresponding to the lower 25% and the data corresponding to the upper 25% after sequentially (e.g., in ascending order) sorting each data according to its value.
  • the processor (1110) may obtain the Q3 value and the Q1 value and then obtain the IQR as the difference therebetween.
  • the processor (1110) may determine a value obtained by multiplying the IQR by the weight (e.g., w 2 ) and adding the value obtained by the Q3 value as the outlier threshold.
  • the weight w 2 may be determined as a different value for each resource.
  • the processor (1110) may also calculate an outlier threshold based on the IQR and the weight w 2 for all data, without verifying normality of the data.
  • the processor (1110) can update an outlier threshold value (e.g., a second outlier threshold value) currently stored in the memory (1120) for the corresponding application and resource with the calculated outlier threshold value.
  • the outlier threshold value can be set to a value less than 0 in an initial state, and can be updated to that value when the outlier threshold value is calculated.
  • the processor (1110) can perform an operation of calculating the outlier threshold value when a sufficient amount of data is collected in the resource usage data set.
  • the processor (1110) may determine whether, when a specific application is executed and uses at least one resource, the usage of the resource exceeds an abnormality threshold value set corresponding to the resource. According to one embodiment, when the usage of the resource exceeds the abnormality threshold value, the processor (1110) may determine that an abnormal operation has occurred due to the execution of the application.
  • the processor (1110) may forcibly terminate an application that has caused an abnormal operation.
  • the processor (1110) may provide a user interface indicating an abnormal operation of the application through the display (1150), as illustrated in FIGS. 8A to 8D.
  • the processor (1110) may provide a notification indicating an abnormal operation of the application through another output device (1140), such as a haptic module (1170) or a speaker (1160).
  • the processor (1110) can check whether the number of times the application causing the abnormal behavior is forced to terminate is greater than or equal to a reference number.
  • the reference number may be 3 times, but is not limited thereto. If the number of times the application is forced to terminate is greater than or equal to the reference number, the processor (1110) can provide a user interface (e.g., the user interface of FIG. 9d) for inducing deletion of the application.
  • FIG. 12 is a block diagram of a process executed in an electronic device according to one embodiment.
  • processes (1200) running on a processor of an electronic device may include a resource manager daemon (1210) and an outlier threshold calculator (1250).
  • the resource manager daemon (1210) may check for an event corresponding to the resource usage of an application when the application is running and uses at least one resource.
  • a resource creation event may be provided in the form of a class (e.g., ResEvt.class(.java)), a Java native interface (JNI) library (e.g., ResEvt JNI library(.cpp)), and/or a shared object (SO) (e.g., LibresEvt.so).
  • a resource creation event may be provided in the form of a class (e.g., ResEvt.class(.java)), a Java native interface (JNI) library (e.g., ResEvt JNI library(.cpp)), and/or a shared object (SO) (e.g., LibresEvt.so).
  • JNI Java native interface
  • SO shared object
  • the resource manager daemon (1210) can record resource usage statistics (1220) and manage anomaly threshold values (1230).
  • the resource manager daemon (1210) can receive application and resource usage information when an application is executed, and record the same in resource usage statistics (1220).
  • the resource usage statistics (1220) can store usage information of multiple applications and each resource used by each application in a table format.
  • the outlier threshold calculator (1250) may perform an operation of calculating an outlier threshold when a predetermined amount of data is accumulated and stored in a resource usage data set (1260) accumulated in a memory.
  • the outlier threshold calculator (1250) may determine at least one outlier threshold corresponding to each of a specific application and at least one resource used when executing the specific application through a predetermined statistical analysis based on the resource usage data set (1260).
  • the outlier threshold calculator (1250) may perform an operation of determining an outlier threshold corresponding to each of the resources for each of a plurality of applications.
  • the anomaly threshold for resource 0 of App 0 , the anomaly threshold for resource 1 , ..., the anomaly threshold for resource j can be calculated, the anomaly threshold for resource 0 of App 1 , the anomaly threshold for resource 1 , ..., the anomaly threshold for resource j of App i , ..., the anomaly threshold for resource 0 , the anomaly threshold for resource 1 , ..., the anomaly threshold for resource j of App i can be calculated.
  • the outlier threshold calculator (1250) can test the normality of usage data of a specific resource of a specific application (1270) to determine whether it follows a normal distribution. If the data follows a normal distribution, the outlier threshold calculator (1250) can calculate a standard deviation and calculate an outlier threshold based on the standard deviation and a predetermined weight (1271). If the data does not follow a normal distribution, the outlier threshold calculator (1250) can calculate an inter quartile range (IQR) and calculate an outlier threshold based on the IQR and a predetermined weight (1272).
  • IQR inter quartile range
  • the method by which the outlier threshold calculator (1250) calculates the outlier threshold value may correspond to the method by which the outlier threshold calculator (1250) of the server device described through FIGS. 4 to 10 calculates the outlier threshold value.
  • the resource manager daemon (1210) when the resource manager daemon (1210) checks a resource usage event, it may compare the usage of each resource with an outlier threshold value corresponding to each resource. If the comparison result confirms that the application of the corresponding event has used a specific resource more than the outlier threshold value, the resource manager daemon (1210) may determine that the corresponding application is operating abnormally due to excessive use of resources. In this case, the resource manager daemon (1210) may not record the usage information of each resource included in the corresponding event in the resource usage statistics.
  • the resource manager daemon (1210) determines that a specific application is behaving abnormally, it can stop the operation of the application (or terminate the execution) and reclaim the resources. After stopping the operation of the application, the resource manager daemon (1210) can provide a notification to the user through an output device (e.g., a display, a speaker, a haptic) indicating the abnormal operation and induce the user to restart the application. If the problem of excessive resource usage occurs repeatedly more than a certain number of times even after the application is restarted, the resource manager daemon (1210) can provide a UI to the user through an output device to induce the user to delete the application.
  • an output device e.g., a display, a speaker, a haptic
  • FIG. 13 is a flowchart of a method for determining an outlier threshold value of an electronic device according to one embodiment.
  • the illustrated method can be performed by an electronic device (e.g., an electronic device (1100) of FIG. 11), and a description of the technical features described above may be omitted below.
  • an electronic device e.g., an electronic device (1100) of FIG. 11
  • the electronic device may check the usage of at least one resource used by the executed application when the application is executed. For example, when a specific application is executed according to a user's input, the executed application may use at least one resource (e.g., CPU usage, memory usage, pending intent creation), and the electronic device may check an event related to the resource usage.
  • the executed application may use at least one resource (e.g., CPU usage, memory usage, pending intent creation), and the electronic device may check an event related to the resource usage.
  • the electronic device may record usage information of a resource in a resource usage data set.
  • the resource usage data set may accumulate and record usage information of each resource used when each application is executed, and the electronic device may add usage information of at least one resource used according to execution of the application to data of the corresponding application and resource in the resource usage data set.
  • the electronic device may determine an outlier threshold corresponding to each application and resource through statistical analysis.
  • the electronic device can perform a normality test on a feature application and resource usage of a resource usage data set. If it is confirmed that specific resource usage information has normality, the electronic device can calculate a standard deviation of the resource usage and determine an outlier threshold based on the calculated standard deviation and a predetermined weight (w 1 ). If the specific resource usage information does not have normality, the electronic device can calculate an inter quartile range (IQR) of the resource usage information and determine an outlier threshold based on the IQR and the predetermined weight (w 2 ).
  • IQR inter quartile range
  • the weight (w 1 ) and the weight (w 2 ) can be determined for each resource.
  • the electronic device can determine respective outlier threshold values corresponding to each application and resource.
  • the electronic device can update the pre-stored outlier threshold value with the calculated outlier threshold value.
  • the electronic device can set the outlier threshold value to a value less than 0 in the initialization step, and then update the outlier threshold value with the calculated value when the outlier threshold value is calculated.
  • the electronic device can perform the operation of calculating the outlier threshold value and update the calculated outlier threshold value again.
  • the electronic device may check the usage of at least one resource used by the executed application, and if the usage of the specific resource is greater than or equal to an abnormal threshold value set for the application and resource, the electronic device may determine that an abnormal operation has occurred due to the executed application. When the abnormal operation has occurred, the electronic device may terminate the execution of the application that has excessively used resources. In addition, the electronic device may provide a notification including information indicating the application in which the abnormal operation has occurred and information indicating at least one resource that has been used in excess of the threshold value, through an output device.
  • An electronic device may include a memory and a processor operatively connected to the memory.
  • the memory can store a resource usage data set that maps and records a plurality of applications and a plurality of resource usages corresponding to each of the plurality of applications.
  • the processor when the first application is executed, can check the usage of at least one resource used by the executed first application, and record the checked usage information of the at least one resource in a resource usage data set stored in the memory.
  • the processor may be configured to determine at least one first outlier threshold value corresponding to each of the first application and at least one resource used when executing the first application through a predetermined statistical analysis based on a resource usage data set stored in the memory, and to update at least one second outlier threshold value set for each of the first application and the at least one resource, which is previously stored in the memory, based on the determined at least one outlier threshold value.
  • the memory may store instructions that, when executed by the processor, cause the electronic device to, when a first application is executed, check the usage of at least one resource used by the executed first application, record the checked usage information of the at least one resource in a resource usage data set stored in the memory, determine at least one first outlier threshold value corresponding to each of the first application and the at least one resource used when executing the first application through a predetermined statistical analysis based on the resource usage data set stored in the memory, and update at least one second outlier threshold value set for each of the first application and the at least one resource, which is previously stored in the memory, based on the determined at least one first outlier threshold value.
  • the processor may be configured not to record usage information of the first resource in a resource usage data set stored in the memory when the usage of the first resource used by the executed first application exceeds an abnormality threshold value set corresponding to the first application and the first resource.
  • the processor may be configured to determine an outlier threshold value corresponding to the second application and the second resource when the amount of usage information of the second resource corresponding to the second application in the resource usage data set stored in the memory exceeds a reference number.
  • the processor may be configured to calculate an inter quartile range (IQR) of usage information of a plurality of second resources recorded corresponding to the second application, and determine an outlier threshold value corresponding to the second application and the second resource based on the calculated IQR and a weight corresponding to the second resource.
  • IQR inter quartile range
  • the weights may be determined for each resource.
  • the processor may be configured to verify whether usage information of a plurality of second resources recorded corresponding to the second application has normality, and if it is verified to have normality, calculate a standard deviation of the usage information of the plurality of second resources, and determine an outlier threshold value corresponding to the second application and the second resource based on the calculated standard deviation.
  • the processor may be configured to, when a third application is executed, check the usage of at least one resource used by the executed third application, and, when the usage of the third resource among the checked usages of at least one resource is equal to or greater than an abnormality threshold value currently set corresponding to the third application and the third resource, determine that an abnormal operation has occurred due to the execution of the third application.
  • the processor may be configured to terminate execution of the third application if it is determined that the abnormal operation has occurred.
  • the processor may be configured to provide feedback to the user when the number of times the third application is terminated due to an abnormal operation occurring during execution of the third application is greater than or equal to a reference number.
  • the electronic device further includes a display
  • the processor may be configured to provide a user interface through the display, the user interface including information indicating a third application in which the abnormal operation occurred and information indicating at least one resource used in excess of the abnormal threshold value.
  • a server device may include a communication interface, a memory, and a processor operatively connected to the communication interface and the memory.
  • the processor may be configured to receive, through the communication interface, usage information of at least one resource used when executing a first application from a plurality of electronic devices, record the received usage information of the resource in a resource usage data set stored in the memory, determine, based on the resource usage data set, at least one outlier threshold value corresponding to each of the first application and the at least one resource used when executing the first application through a predetermined statistical analysis, and transmit the determined outlier threshold value to the plurality of electronic devices through the communication interface.
  • the memory may store instructions that, when executed by the processor, cause the processor to receive, from a plurality of electronic devices via the communication interface, usage information of at least one resource used when executing a first application, record the received usage information of the resource in a resource usage data set stored in the memory, determine at least one outlier threshold value corresponding to each of the first application and the at least one resource used when executing the first application through a predetermined statistical analysis based on the resource usage data set, and transmit the determined outlier threshold value to the plurality of electronic devices via the communication interface.
  • the processor may be configured to determine an outlier threshold value corresponding to the first application and the first resource when the amount of usage information of the first resource corresponding to the first application is stored in the resource usage data set stored in the memory in a number greater than or equal to a reference number.
  • the processor may be configured to calculate an inter quartile range (IQR) of usage information of a plurality of first resources recorded corresponding to the first application, and determine an outlier threshold value corresponding to the first application and the first resource based on the calculated IQR and a weight corresponding to the first resource.
  • IQR inter quartile range
  • the weights may be determined for each resource.
  • the processor may be configured to verify whether usage information of a plurality of first resources recorded corresponding to the first application has normality, and if it is verified to have normality, calculate a standard deviation of the usage information of the plurality of first resources, and determine an outlier threshold value corresponding to the first application and the first resource based on the calculated standard deviation.
  • a method performed by a server device may include an operation of receiving usage information of at least one resource used when executing a first application from a plurality of electronic devices, an operation of recording the received usage information of the resource in a resource usage data set stored in a memory, an operation of determining at least one outlier threshold value corresponding to each of the first application and the at least one resource used when executing the first application through a predetermined statistical analysis based on the resource usage data set, and an operation of transmitting the determined outlier threshold value to the plurality of electronic devices.
  • the operation of determining at least one outlier threshold value may include an operation of determining an outlier threshold value corresponding to the first application and the first resource when the amount of usage information of the first resource corresponding to the first application is stored in the stored resource usage data set in a number greater than or equal to a reference number.
  • the operation of determining at least one outlier threshold value may include the operation of calculating an inter quartile range (IQR) of usage information of a plurality of first resources recorded corresponding to the first application, and the operation of determining an outlier threshold value corresponding to the first application and the first resource based on the calculated IQR and a weight corresponding to the first resource.
  • IQR inter quartile range
  • the weights may be determined for each resource.
  • the operation of determining the at least one outlier threshold value may include the operation of checking whether usage information of a plurality of first resources recorded corresponding to the first application has normality, and if it is checked that the usage information has normality, calculating a standard deviation of the usage information of the plurality of first resources, and determining an outlier threshold value corresponding to the first application and the first resource based on the calculated standard deviation.
  • An electronic device may include a display, a memory, and a processor operatively connected to the display and the memory.
  • the memory can store a plurality of outlier threshold values, each corresponding to a plurality of applications and a plurality of resources.
  • the processor may be configured to, when a first application is executed, check the usage of at least one resource used by the executed first application, check at least one abnormality threshold value corresponding to each of the first application and the at least one resource used in the memory, compare the usage of the first resource among the at least one identified resource with the first abnormality threshold value corresponding to the first application and the first resource, and determine that an abnormal operation has occurred due to the execution of the first application when the usage of the first resource is equal to or greater than the first abnormality threshold value.
  • the processor may be configured to terminate execution of the first application if it is determined that the abnormal operation has occurred.
  • the processor may be configured to provide feedback to the user when the number of times the first application is terminated due to an abnormal operation occurring during execution of the first application is greater than or equal to a reference number.
  • the electronic devices according to various embodiments disclosed in this document may be devices of various forms.
  • the electronic devices may include, for example, portable communication devices (e.g., smartphones), computer devices, portable multimedia devices, portable medical devices, cameras, wearable devices, or home appliance devices.
  • portable communication devices e.g., smartphones
  • computer devices portable multimedia devices
  • portable medical devices e.g., cameras
  • wearable devices e.g., smart watch devices
  • home appliance devices e.g., smartphones
  • the electronic devices according to embodiments of this document are not limited to the above-described devices.
  • first, second, or first or second may be used merely to distinguish one component from another, and do not limit the components in any other respect (e.g., importance or order).
  • a component e.g., a first
  • another component e.g., a second
  • functionally e.g., a third component
  • module used in various embodiments of this document may include a unit implemented in hardware, software or firmware, and may be used interchangeably with terms such as logic, logic block, component, or circuit, for example.
  • a module may be an integrally configured component or a minimum unit of the component or a portion thereof that performs one or more functions.
  • a module may be implemented in the form of an application-specific integrated circuit (ASIC).
  • ASIC application-specific integrated circuit
  • Various embodiments of the present document may be implemented as software (e.g., a program (140)) including one or more instructions stored in a storage medium (e.g., an internal memory (136) or an external memory (138)) readable by a machine (e.g., an electronic device (101)).
  • a processor e.g., a processor (120)
  • the machine e.g., an electronic device (101)
  • the one or more instructions may include code generated by a compiler or code executable by an interpreter.
  • the machine-readable storage medium may be provided in the form of a non-transitory storage medium.
  • ‘non-transitory’ simply means that the storage medium is a tangible device and does not contain signals (e.g. electromagnetic waves), and the term does not distinguish between cases where data is stored semi-permanently or temporarily on the storage medium.
  • the method according to various embodiments disclosed in the present document may be provided as included in a computer program product.
  • the computer program product may be traded between a seller and a buyer as a commodity.
  • the computer program product may be distributed in the form of a machine-readable storage medium (e.g., a compact disc read only memory (CD-ROM)), or may be distributed online (e.g., downloaded or uploaded) via an application store (e.g., Play Store TM ) or directly between two user devices (e.g., smart phones).
  • an application store e.g., Play Store TM
  • at least a part of the computer program product may be at least temporarily stored or temporarily generated in a machine-readable storage medium, such as a memory of a manufacturer's server, a server of an application store, or an intermediary server.
  • each component e.g., a module or a program of the above-described components may include a single or multiple entities, and some of the multiple entities may be separately arranged in other components.
  • one or more components or operations of the above-described corresponding components may be omitted, or one or more other components or operations may be added.
  • the multiple components e.g., a module or a program
  • the integrated component may perform one or more functions of each of the multiple components identically or similarly to those performed by the corresponding component of the multiple components before the integration.
  • the operations performed by the module, program, or other component may be executed sequentially, in parallel, repeatedly, or heuristically, or one or more of the operations may be executed in a different order, omitted, or one or more other operations may be added.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Quality & Reliability (AREA)
  • Computer Hardware Design (AREA)
  • Debugging And Monitoring (AREA)

Abstract

Selon divers modes de réalisation, le présent document concerne un dispositif électronique qui peut comprendre une mémoire et un processeur connecté fonctionnellement à la mémoire. La mémoire peut stocker un ensemble de données d'utilisation de ressources dans lequel une pluralité d'applications et une pluralité de quantités d'utilisation de ressources correspondant à la pluralité d'applications, respectivement, sont mappées et enregistrées. La mémoire peut stocker des instructions qui, lorsqu'elles sont exécutées par le processeur, amènent le dispositif électronique : si une première application est exécutée, à identifier la quantité d'utilisation d'au moins une ressource utilisée par la première application exécutée ; à enregistrer des informations concernant la quantité d'utilisation identifiée de la ou des ressources dans un ensemble de données d'utilisation de ressources stocké dans la mémoire ; à déterminer au moins une valeur de seuil aberrant correspondant à la première application et au moins une ressource utilisée lorsque la première application est exécutée, respectivement, par une analyse statistique prédéterminée sur la base de l'ensemble de données d'utilisation de ressources stocké dans la mémoire ; et à mettre à jour au moins une valeur de seuil aberrant configurée par rapport à la première application pré-stockée et à la ou aux ressources, respectivement, sur la base de la ou des valeurs de seuil aberrant déterminées. Divers autres modes de réalisation sont possibles.
PCT/KR2024/007587 2023-06-05 2024-06-03 Dispositif électronique et procédé de détection d'application utilisant une ressource de dispositif électronique de façon excessive Ceased WO2024253401A1 (fr)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
KR10-2023-0072349 2023-06-05
KR20230072349 2023-06-05
KR1020230082921A KR20240173569A (ko) 2023-06-05 2023-06-27 전자 장치 및 전자 장치의 리소스를 과다 사용하는 어플리케이션을 감지하는 방법
KR10-2023-0082921 2023-06-27

Publications (1)

Publication Number Publication Date
WO2024253401A1 true WO2024253401A1 (fr) 2024-12-12

Family

ID=93796154

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/KR2024/007587 Ceased WO2024253401A1 (fr) 2023-06-05 2024-06-03 Dispositif électronique et procédé de détection d'application utilisant une ressource de dispositif électronique de façon excessive

Country Status (1)

Country Link
WO (1) WO2024253401A1 (fr)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20120026046A (ko) * 2009-04-30 2012-03-16 마이크로소프트 코포레이션 애플리케이션 효율 엔진
KR20170065085A (ko) * 2015-12-02 2017-06-13 삼성전자주식회사 시스템 리소스 관리를 위한 방법 및 장치
US20180332107A1 (en) * 2012-09-20 2018-11-15 Amazon Technologies, Inc. Automated profiling of resource usage
KR101987664B1 (ko) * 2018-07-19 2019-06-11 나무기술 주식회사 클라우드 플랫폼에서 복수의 클러스터 및 어플리케이션을 모니터링하는 방법
KR20200052361A (ko) * 2017-10-13 2020-05-14 후아웨이 테크놀러지 컴퍼니 리미티드 클라우드-디바이스 협업적 실시간 사용자 사용 및 성능 비정상 검출을 위한 시스템 및 방법

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20120026046A (ko) * 2009-04-30 2012-03-16 마이크로소프트 코포레이션 애플리케이션 효율 엔진
US20180332107A1 (en) * 2012-09-20 2018-11-15 Amazon Technologies, Inc. Automated profiling of resource usage
KR20170065085A (ko) * 2015-12-02 2017-06-13 삼성전자주식회사 시스템 리소스 관리를 위한 방법 및 장치
KR20200052361A (ko) * 2017-10-13 2020-05-14 후아웨이 테크놀러지 컴퍼니 리미티드 클라우드-디바이스 협업적 실시간 사용자 사용 및 성능 비정상 검출을 위한 시스템 및 방법
KR101987664B1 (ko) * 2018-07-19 2019-06-11 나무기술 주식회사 클라우드 플랫폼에서 복수의 클러스터 및 어플리케이션을 모니터링하는 방법

Similar Documents

Publication Publication Date Title
WO2020213818A1 (fr) Dispositif électronique et procédé de réalisation de transition rapide entre écrans
WO2020246822A1 (fr) Dispositif électronique et procédé pour faire basculer un dispositif électronique entre un mode double veille et un mode simple veille
WO2018097557A2 (fr) Dispositif électronique comprenant une antenne
WO2019039868A1 (fr) Dispositif électronique d'affichage d'application et son procédé de fonctionnement
WO2022019484A1 (fr) Dispositif électronique comprenant un écran, et procédé de commande d'écran associé
WO2024253401A1 (fr) Dispositif électronique et procédé de détection d'application utilisant une ressource de dispositif électronique de façon excessive
WO2022215859A1 (fr) Dispositif électronique pour mettre en oeuvre une fonction de capture et procédé pour faire fonctionner un dispositif électronique
WO2023059012A1 (fr) Dispositif électronique pour configurer un paramètre twt sur la base d'un signal de réponse reçu en provenance d'un dispositif électronique externe d'un autre bss, et procédé de fonctionnement d'un dispositif électronique
WO2023033438A1 (fr) Dispositif électronique pour réaliser un appariement entre des dispositifs électroniques et son procédé de fonctionnement
WO2022019715A1 (fr) Procédé et appareil pour fournir une recherche de contenu à l'aide d'un clavier dans un dispositif électronique
WO2022080806A1 (fr) Dispositif électronique comprenant un affichage souple, et procédé de régulation de température en fonction de l'état d'un dispositif électronique l'utilisant
WO2023085853A1 (fr) Dispositif électronique de récupération de fichier et procédé de fonctionnement de dispositif électronique
WO2017082615A1 (fr) Dispositif électronique d'émission de signal audio et dispositif émetteur connecté au dispositif électronique
WO2024158199A1 (fr) Dispositif électronique et procédé de détection de changement de performance dans un dispositif électronique
WO2025018836A1 (fr) Dispositif électronique et procédé d'affichage d'écran récent
WO2025146990A1 (fr) Dispositif électronique pour déterminer une fréquence cardiaque en sommeil et/ou une variabilité de fréquence cardiaque en sommeil, et procédé de fonctionnement de dispositif électronique
WO2025192910A1 (fr) Dispositif électronique pour générer une politique pour bloquer des messages, son procédé de fonctionnement et support d'enregistrement
WO2026010319A1 (fr) Dispositif électronique à porter sur soi pour exécuter une fonction, son procédé de fonctionnement et support d'enregistrement
WO2026023937A1 (fr) Dispositif électronique de traitement d'erreur de communication, procédé de fonctionnement associé et support de stockage
WO2025211628A1 (fr) Dispositif électronique et procédé de fonctionnement associé
WO2025220835A1 (fr) Dispositif électronique, procédé et support d'enregistrement non transitoire lisible par ordinateur pour maintenir une liaison de communication
WO2026010170A1 (fr) Dispositif électronique, procédé et support de stockage pour mettre à jour un écran comportant des informations de notification
WO2025028783A1 (fr) Dispositif électronique et procédé de fonctionnement associé
WO2026019040A1 (fr) Dispositif électronique comprenant une masse
WO2026034822A1 (fr) Dispositif électronique destiné à fournir un service de localisation, procédé de fonctionnement associé, et support de stockage

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 24819552

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE