Identifying whether an application is malicious

A method comprising:

• detecting a first application being presented for installation on a processing system;
• scanning, via a static analysis implemented by a processor, the first application to determine whether a user interface layout of the first application is suspiciously similar to a user interface layout of a second application installed on the processing system and to determine a total number of possible user interface layouts of the first application, wherein the user interface layout of the first application being suspiciously similar to the user interface layout of a second application indicates the first application is attempting to emulate the second application;
• responsive to the static analysis being indeterminate as to whether the first application is suspiciously similar to the user interface layout of the second application, responsive to the first application being executed, performing a runtime analysis of the first application to identify each user interface layout implemented by the first application, and determining whether each user interface layout implemented by the first application is suspiciously similar to a user interface layout of the second application;
• and
• responsive to the runtime analysis indicating that a total number of the first application user interface layouts detected by the runtime analysis equals the total number of possible user interface layouts determined by the static analysis, and that at least one of the first application user interface layouts is suspiciously similar to the user interface layout of the second application installed on the processing system, identifying the first application as being unsafe.

A processing system comprising:

• a hardware processor configured to initiate executable operations comprising:
• detecting a first application being presented for installation on a processing system;
• scanning, via a static analysis, the first application to determine whether a user interface layout of the first application is suspiciously similar to a user interface layout of a second application installed on the processing system and to determine a total number of possible user interface layouts of the first application, wherein the user interface layout of the first application being suspiciously similar to the user interface layout of a second application indicates the first application is attempting to emulate the second application;
• responsive to the static analysis being indeterminate as to whether the first application is suspiciously similar to the user interface layout of the second application, responsive to the first application being executed, performing a runtime analysis of the first application to identify each user interface layout implemented by the first application, and determining whether each user interface layout implemented by the first application is suspiciously similar to a user interface layout of the second application;
• and
• responsive to the runtime analysis indicating that a total number of the first application user interface layouts detected by the runtime analysis equals the total number of possible user interface layouts determined by the static analysis, and that at least one of the first application user interface layouts is suspiciously similar to the user interface layout of the second application installed on the processing system, identifying the first application as being unsafe.

A computer program product comprising:

• a computer-readable storage device, wherein the computer-readable storage device is not a transitory, propagating signal per se, having stored thereon program code that, when executed, configures a processor to perform operations comprising:
• detecting a first application being presented for installation on a processing system;
• scanning, via a static analysis, the first application to determine whether a user interface layout of the first application is suspiciously similar to a user interface layout of a second application installed on the processing system and to determine a total number of possible user interface layouts of the first application, wherein the user interface layout of the first application being suspiciously similar to the user interface layout of a second application indicates the first application is attempting to emulate the second application;
• responsive to the static analysis being indeterminate as to whether the first application is suspiciously similar to the user interface layout of the second application, responsive to the first application being executed, performing a runtime analysis of the first application to identify each user interface layout implemented by the first application, and determining whether each user interface layout implemented by the first application is suspiciously similar to a user interface layout of the second application;
• and
• responsive to the runtime analysis indicating that a total number of the first application user interface layouts detected by the runtime analysis equals the total number of possible user interface layouts determined by the static analysis, and that at least one of the first application user interface layouts is suspiciously similar to the user interface layout of the second application installed on the processing system, identifying the first application as being unsafe.