On-Device Maliciousness Categorization of Application Programs for Mobile Devices

A computer program product for determining whether an application program is malicious, the computer program product comprising a non-transitory machine-readable medium storing computer program code for performing a method, the method comprising:

• executing, on a client device, the application program, the client device including an instrumentation for recording behavior of the application program during execution;
• recording, on the client device, a set of behaviors of the application program during execution, the set of behaviors including at least one of an application layer behavior, an application framework behavior, a kernel layer behavior, and a hardware layer behavior;
• and
• categorizing the application program as regular or malicious based on the set of behaviors recorded.

A device for determining whether an application program is malicious, comprising:

• a processor;
• and
• non-transitory machine-readable medium storing instructions configured to cause the processor to perform:
• executing the application program, wherein the instructions comprise instructions of an instrumentation for recording behavior of the application program during execution;
• recording a set of behaviors of the application program during execution, the set of behaviors including at least one of an application layer behavior, an application framework behavior, a kernel layer behavior, and a hardware layer behavior;
• and
• categorizing the application program as regular or malicious based on the set of behaviors recorded.