Aggregate event profiles for detecting malicious mobile applications

A computer system having at least one hardware processor configured to execute a method of protecting against malicious software showing variations in behavior across a plurality of client devices, the method comprising:

• selecting a first plurality of events and a second plurality of events from a pool of events, the first and second pluralities of events selected to all have been caused by instances of a target software application, wherein:
• the first plurality of events was caused by one instance of the target application executing on a client device of the plurality of client devices, and
• the second plurality of events was caused by another instance of the target application executing on another client device of the plurality of client devices;
• merging the first and second pluralities of events into an aggregate event sequence wherein individual events are arranged according to a time of occurrence of each event;
• constructing a behavioral signature of the target software application according to the aggregate event sequence, the behavioral signature comprising a subset of events of the aggregate event sequence and wherein constructing the behavioral signature comprises including a selected event of the aggregate event sequence into the behavioral signature according to whether the selected event is indicative of malice and further according to whether both the first and second pluralities of events include instances of the selected event;
• and
• saving the behavioral signature to a repository, wherein the behavioral signature allows a malware detector to detect malicious software according to the behavioral signature.

A non-transitory computer-readable medium storing instructions which, when executed by at least one hardware processor of a computer system, cause the computer system to execute a method of protecting against malware showing variations of behavior across a plurality of client devices, the method comprising:

• selecting a first plurality of events and a second plurality of events from a pool of events, the first and second pluralities of events selected to all have been caused by instances of a target software application, wherein:
• the first plurality of events was caused by one instance of the target application executing on a client device of a plurality of client devices, and
• the second plurality of events was caused by another instance of the target application executing on another client device of the plurality of client devices;
• merging the first and second pluralities of events into an aggregate event sequence wherein individual events are arranged according to a time of occurrence of each event;
• determining whether the target application is malicious according to the aggregate event sequence;
• constructing a behavioral signature of the target software application according to the aggregate event sequence, the behavioral signature comprising a subset of events of the aggregate event sequence and wherein constructing the behavioral signature comprises including a selected event of the aggregate event sequence into the behavioral signature according to whether the selected event is indicative of malice and further according to whether both the first and second pluralities of events include instances of the selected event;
• and
• saving the behavioral signature to a repository, wherein the behavioral signature allows a malware detector to detect malicious software according to the behavioral signature.