Malicious application detection

A system for monitoring network activity, the system comprising:

• an interface for at least receiving connection data associated with a request from a first device to download an application from a source;
• a second device configured to download the application based on the request;
• and
• one or more processors executing instructions stored on memory to:
• execute the downloaded application to obtain behavioral data of the application,
• assign a risk score to the application based on the behavioral data of the application to determine whether the application is malicious before the application is downloaded to the first device, and
• implement a download decision for the first device based on the assigned risk score, wherein the download decision indicates at least whether the first device is able to download the application associated with the request.

A computer program product for monitoring network activity, the computer program product comprising computer executable code embodied in one or more non-transitory computer readable media that, when executing on one or more processors, performs the steps of:

• receiving connection data associated with a request from a first device to download an application from a source;
• downloading the application to a second device based on the request;
• executing the downloaded application to obtain behavioral data of the application;
• assigning a risk score to the application based on the behavioral data of the application to determine whether the application is malicious before the application is downloaded to the first device;
• and
• implementing a download decision for the first device based on the assigned risk score, wherein the download decision indicates at least whether the first device is able to download the application associated with the request.