Software package analysis for detection of malicious properties

One or more non-transitory computer-readable media having program code stored thereon that is executable by a computing device, the program code comprising instructions to:

• load a first application with known behavior into a controlled execution environment;
• associate a software package with the first application in the controlled execution environment;
• based on a plurality of rules for detecting deviations in behavior from the known behavior of the first application, evaluate behavior patterns observed during execution of the loaded first application with the associated software package;
• based on a determination that one or more of the behavior patterns satisfy corresponding ones of the plurality of rules, determine that the one or more behavior patterns correspond to one or more behaviors that deviate from the known behavior of the first application and are attributable to the software package;
• compute a score for the software package based on scores assigned to the one or more behaviors that deviated from the known behavior;
• and
• determine whether the software package is malicious based on evaluation of the score computed for the software package.

An apparatus comprising:

• a processor;
• and
• a computer-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
• load a first application with known behavior into a controlled execution environment;
• import a software package into the first application;
• based on execution of the loaded first application with the imported software package, determine one or more behaviors that are attributable to the software package based on identification of deviations in behavior from the known behavior,
• wherein the instructions to determine the one or more behaviors comprise instructions to evaluate of behavior patterns recorded during execution of the first application with the software package associated based on first criteria for detecting behavior deviations and determine that one or more of the behavior patterns satisfy respective ones of the first criteria;
• compute a score indicative of trustworthiness of the software package based on the one or more behaviors attributable to the software package;
• and
• based on evaluation of the score computed for the software package, determine that the software package is malicious.