Behavioral scanning of mobile applications

A system comprising:

• one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
• obtaining an application;
• executing the application in an emulated environment, the emulated environment including a user interface exerciser configured to generate a stream of simulated events as inputs to the application executing on a mobile device;
• analyzing a plurality of behavior signals of the application responsive to the stream of simulated events, wherein a first behavior signal of the application includes application requests for address entries on the mobile device;
• calculating a likelihood of maliciousness for each of the behavior signals;
• calculating a combined likelihood of maliciousness for the application based on the likelihood of maliciousness for each of the behavior signals;
• and
• classifying the application as malicious or not malicious based on the combined likelihood of maliciousness.

One or more non-transitory computer-readable storage media encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising:

• obtaining an application;
• executing the application in an emulated environment, the emulated environment including a user interface exerciser configured to generate a stream of simulated events as inputs to the application executing on a mobile device;
• analyzing a plurality of behavior signals of the application responsive to the stream of simulated events, wherein a first behavior signal of the application includes application requests for address entries on the mobile device;
• calculating a likelihood of maliciousness for each of the behavior signals;
• calculating a combined likelihood of maliciousness for the application based on the likelihood of maliciousness for each of the behavior signals;
• and
• classifying the application as malicious or not malicious based on the combined likelihood of maliciousness.