# US 2014/0196150 A1 · Quantifying the risks of applications for mobile devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0196150 A1 - Document ID: US20140196150A1 - Status: Published application - Kind: A1 - Application number: 14/205,220 - Filed: 2014-03-11 - Published: 2014-07-10 - Earliest claimed: 2012-02-24 - Assignees: Appthority, Inc. - Applicants: Appthority, Inc. - Inventors: Anthony John Bettini; Kevin Watkins; Domingo J. Guerra; Michael Price - Web page: https://patentgrep.com/patent/US20140196150A1 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 16/951: Indexing; Web crawling techniques - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Quantifying the risks of applications (“apps”) for mobile devices is disclosed. In some embodiments, quantifying the risks of apps for mobile devices includes receiving an application for a mobile device; performing an automated analysis of the application based on a risk profile; and generating a risk score based on the automated analysis of the application based on the risk profile. ## Claims ### Claim 1 A system for quantifying risks of applications (“apps”) for mobile devices, comprising: a processor configured to: receive an application for a mobile device; perform an automated analysis of the application based on a risk profile, wherein the risk profile is based on an enterprise policy that includes custom rules for scanning of apps based on security requirements to determine whether the application includes previously known malware, exhibits new malware behaviors, poses a privacy or security risk, or any combination thereof; generate a risk score based on the automated analysis of the application based on the risk profile; and perform an action based on the risk score; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein perform the action based on the risk score includes: report the risk score. ### Claim 3 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: determine whether the application is in violation of the enterprise policy, wherein the enterprise policy includes a malware policy for apps. ### Claim 4 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: customize the risk score based on a customized risk scoring profile, wherein the customized risk scoring profile includes an enterprise-based customization. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: perform a pre-screening phase that includes checking an application cache, wherein the application cache includes risk scores for previously analyzed apps. ### Claim 6 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: perform a pre-screening phase that includes checking an application cache, wherein the application cache includes risk scores for previously analyzed apps that are available from a public app store. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: respond to an app query using an application cache, wherein the application cache includes risk scores for previously analyzed apps. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: check an application cache, wherein the application cache includes risk scores for previously analyzed applications, and wherein checking the application cache includes: determine whether the application has been previously analyzed; and in the event that the application has been previously analyzed, determine whether to return the previously determined risk score of the application. ### Claim 9 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: query public app market data relating to the application, the public app market data including an application description, an application ranking in a store, a vendor reputation of the application, or any combination thereof. ### Claim 10 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: extract metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof; and query public app market data relating to the application based on the extracted metadata associated with the application, the public app market data including an application description, an application ranking in a store, a vendor reputation of the application, or any combination thereof. ### Claim 11 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: upload the application from a private app store to perform the automated analysis of the application based on the risk profile. ### Claim 12 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: upload the application from a private app store to perform the automated analysis of the application based on the risk profile, wherein the application is marked as private and is hidden from global app cache queries performed during a pre-screening phase. ### Claim 13 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: determine whether the application performs one or more of sending text/SMS messages without user's permission or using GPS/location services without user's permission. ### Claim 14 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: determine a reputation associated with the application. ### Claim 15 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: perform a static analysis on the application during the automated analysis of the application based on the risk profile. ### Claim 16 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: perform a dynamic analysis on the application during the automated analysis of the application based on the risk profile. ### Claim 17 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: perform a dynamic analysis on the application during the automated analysis of the application based on the risk profile, wherein performing the dynamic analysis includes simulating a plurality of behaviors of the application during execution on a mobile device platform. ### Claim 18 A method of quantifying risks of applications (“apps”) for mobile devices, comprising: receiving an application for a mobile device; performing an automated analysis of the application based on a risk profile, wherein the risk profile is based on an enterprise policy that includes custom rules for scanning of apps based on security requirements to determine whether the application includes previously known malware, exhibits new malware behaviors, poses a privacy or security risk, or any combination thereof; generating a risk score based on the automated analysis of the application based on the risk profile; and performing an action based on the risk score. ### Claim 19 (depends on 18) The method of claim 18, wherein performing the action based on the risk score includes: reporting the risk score. ### Claim 20 (depends on 18) The method of claim 18, further comprising: determining whether the application is in violation of the enterprise policy, wherein the enterprise policy includes a malware policy for apps. ### Claim 21 (depends on 18) The method of claim 18, further comprising: customizing the risk score based on a customized risk scoring profile, wherein the customized risk scoring profile includes an enterprise-based customization. ### Claim 22 A computer program product for quantifying risks of applications (“apps”) for mobile devices, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for: receiving an application for a mobile device; performing an automated analysis of the application based on a risk profile, wherein the risk profile is based on an enterprise policy that includes custom rules for scanning of apps based on security requirements to determine whether the application includes previously known malware, exhibits new malware behaviors, poses a privacy or security risk, or any combination thereof; generating a risk score based on the automated analysis of the application based on the risk profile; and performing an action based on the risk score. ### Claim 23 (depends on 22) The computer program product recited in claim 22, wherein performing the action based on the risk score includes: reporting the risk score. ### Claim 24 (depends on 22) The computer program product recited in claim 22, further comprising computer instructions for: determining whether the application is in violation of the enterprise policy, wherein the enterprise policy includes a malware policy for apps. ### Claim 25 (depends on 22) The computer program product recited in claim 22, further comprising computer instructions for: customizing the risk score based on a customized risk scoring profile, wherein the customized risk scoring profile includes an enterprise-based customization.