Detecting Application Harmful Behavior and Grading Application Risks for Mobile Devices

A non-transitory computer-readable storage medium containing instructions, that when executed, control a computer system to be configured for:

• determining a permission list from an application;
• generating a set of potential behaviors from the permission list, the set of potential behaviors associated with actions that the application allows when executing on a mobile device, wherein the set of potential behaviors are determined without execution of the application;
• determining functional category information regarding a functional category from a set of application marketplaces that contain the application;
• determining application description information for the application from the set of application marketplaces;
• generating a required behavior list including a set of required behaviors from the functional category information and the application description information;
• comparing the set of required behaviors to the set of potential behaviors to determine a set of security related behaviors, wherein security related behaviors are behaviors found in the set of potential behaviors, but not in the set of required behaviors;
• and
• determining a security rating based on the set of security related behaviors.

An apparatus comprising:

• one or more computer processors;
• and
• a non-transitory computer-readable storage medium comprising instructions, that when executed, control the one or more computer processors to be configured for:
• determining a permission list from an application;
• generating a set of potential behaviors from the permission list, the set of potential behaviors associated with actions that the application allows when executing on a mobile device, wherein the set of potential behaviors are determined without execution of the application;
• determining functional category information regarding a functional category from a set of application marketplaces that contain the application;
• determining application description information for the application from the set of application marketplaces;
• generating a required behavior list including a set of required behaviors from the functional category information and the application description information;
• comparing the set of required behaviors to the set of potential behaviors to determine a set of security related behaviors, wherein security related behaviors are behaviors found in the set of potential behaviors, but not in the set of required behaviors;
• and
• determining a security rating based on the set of security related behaviors.