Systems and methods for application security analysis

A mobile device management system, comprising:

• one or more enterprise devices that provide enterprise services;
• and
• an application analysis system, comprising a processor that executes instructions stored in memory to:
• detect mobile devices attempting to access the enterprise services;
• and
• conduct an analysis of a plurality of applications residing on the mobile devices, the mobile devices being configurable to access an enterprise system, the analysis comprising:
• comparing the plurality of applications to a whitelist and blacklist;
• for each of the plurality of applications not on the whitelist or blacklist, evaluating each of the plurality of applications for each of privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior, the evaluating comprising performing a static, dynamic, and behavior analysis of each of the plurality of applications for each of the privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior;
• calculating a score for each of the plurality of applications based on the application behaviors;
• and
• automatically remediating respective applications of the plurality of applications if the score calculated for the respective applications meets or exceeds a score threshold.

A non-transitory computer-readable storage medium having embodied thereon instructions, which, when executed by at least one processor, perform steps of a method, the method comprising:

• evaluating each of a plurality of applications for each of privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior, the plurality of applications residing on a mobile device, the mobile device being configurable to access an enterprise system, the evaluating comprising:
• performing a static analysis of each of the plurality of applications for each of the privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior;
• performing a dynamic analysis of each of the plurality of applications for each of the privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior;
• and
• performing a behavior analysis of each of the plurality of applications for each of the privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior;
• based on the static analysis, dynamic analysis, and behavior analysis, calculating a score for each of the plurality of applications;
• determining whether each of the plurality of applications meets or exceeds a score threshold;
• and
• automatically remediating the applications, of the plurality of applications, for which the score meets or exceeds the score threshold.