Automated behavioral and static analysis using an instrumented sandbox and machine learning classification for mobile security

A method comprising:

• based on receiving a request to analyze a first mobile application, scheduling the request for a first sandbox;
• performing an analysis of the first mobile application based on the request, wherein performing the analysis of the first mobile application comprises performing a behavioral analysis of the first mobile application within the first sandbox and performing a static analysis of the first mobile application;
• generating a first feature vector based on data resulting from the behavioral analysis and the static analysis of the first mobile application;
• and
• determining that the first mobile application comprises malware based, at least in part, on comparing the first feature vector with at least a second feature vector, wherein the second feature vector was previously generated based on a static analysis and a behavioral analysis of known malware.

A non-transitory, computer-readable medium having instructions stored thereon that are executable by a computing device to perform operations comprising:

• based on receiving a request to analyze a first mobile application, scheduling the request for a first sandbox;
• performing an analysis of the first mobile application based on the request, wherein performing the analysis of the first mobile application comprises performing a behavioral analysis of the first mobile application within the first sandbox and performing a static analysis of the first mobile application;
• generating a first feature vector based on data resulting from the behavioral analysis and the static analysis of the first mobile application;
• and
• determining whether the first mobile application comprises malware based, at least in part, on comparing the first feature vector with at least a second feature vector, wherein the second feature vector was previously generated based on a static analysis and a behavioral analysis of known malware.