# US 8,544,095 B2 · System and method for server-coupled application re-analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,544,095 B2 - Document ID: US8544095B2 - Status: Granted - Kind: B2 - Application number: 13/460,549 - Filed: 2012-04-30 - Published: 2012-11-15 - Granted: 2013-09-24 - Earliest claimed: 2008-10-21 - Assignees: Lookout, Inc. - Applicants: Kevin Patrick Mahaffey; James David Burgess; David Golombek; Timothy Micheal Wyatt; Anthony McKay Lineberry; Kyle Barton; Daniel Lee Evans; David Luke Richardson; Ariel Salomon - Inventors: Kevin Patrick Mahaffey; James David Burgess; David Golombek; Timothy Micheal Wyatt; Anthony McKay Lineberry; Kyle Barton; Daniel Lee Evans; David Luke Richardson; Ariel Salomon - Web page: https://patentgrep.com/patent/US8544095B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/564: {by virus signature recognition} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 63/1433: {Vulnerability analysis} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract To prevent malware, spyware and other undesirable applications from affecting mobile communication devices (e.g., smartphones, netbooks, and tablets), a device uses a server to assist in identifying and removing undesirable applications. When scanning an application, a device transmits information about the application to a server for analysis. The server receives the information, produces a categorization assessment and can provide a categorization re-assessment, and transmits the assessment to the device. By performing analysis on a server, a device can reduce its battery and performance cost of protecting against undesirable applications. The server transmits notifications to devices that have installed applications that are discovered to be undesirable. The server receives data about applications from many devices, using the combined data to minimize false positives and provide comprehensive protection against known and unknown threats. The server can accumulate this data and perform a categorization re-assessment of a data object previously assessed. ## Claims ### Claim 1 A method for re-assessing a data object by a server computer comprising: a) at the server computer, receiving data about a data object residing on a mobile communication device, and storing the data in a data store accessible to the server computer; b) at the server computer, analyzing the data about the data object to produce a categorization assessment, and storing the categorization assessment in the data store accessible to the server computer; c) at the server computer, based upon a trigger selected from the group consisting of receipt of more data about the data object, receipt of more data about mobile communication devices, and an update to the server computer analyzing capability, re-analyzing the data about the data object; d) at the server computer, based upon the re-analyzing, producing an updated categorization assessment; and, e) at the server computer, sending a remediation instruction to the mobile communication device based upon the updated categorization assessment. ### Claim 2 (depends on 1) The method of claim 1 wherein the data received in step (a) is binary data from the data object. ### Claim 3 (depends on 1) The method of claim 1 wherein the data received in step (a) is metadata about the data object. ### Claim 4 (depends on 1) The method of claim 1 wherein the data received in step (a) is behavioral data about the data object. ### Claim 5 (depends on 1) The method of claim 1 wherein the analyzing in step (b) uses API analysis. ### Claim 6 (depends on 1) The method of claim 1 wherein the analyzing in step (b) uses static analysis. ### Claim 7 (depends on 1) The method of claim 1 wherein the analyzing in step (b) uses dynamic analysis. ### Claim 8 (depends on 1) The method of claim 1 wherein the analyzing in step (b) uses behavioral analysis. ### Claim 9 (depends on 1) The method of claim 1 wherein the analyzing in step (b) uses code path analysis. ### Claim 10 (depends on 1) The method of claim 1 wherein the re-analyzing in step (c) uses API analysis. ### Claim 11 (depends on 1) The method of claim 1 wherein the re-analyzing in step (c) uses static analysis. ### Claim 12 (depends on 1) The method of claim 1 wherein the re-analyzing in step (c) uses dynamic analysis. ### Claim 13 (depends on 1) The method of claim 1 wherein the re-analyzing in step (c) uses behavioral analysis. ### Claim 14 (depends on 1) The method of claim 1 wherein the re-analyzing in step (c) uses code path analysis. ### Claim 15 (depends on 1) The method of claim 1 wherein the sending a remediation instruction in step (e) includes an action of instructing a software application on the mobile communication device. ### Claim 16 (depends on 1) The method of claim 1 wherein the sending a remediation instruction in step (e) includes sending a message to a user via a messaging system. ### Claim 17 (depends on 1) The method of claim 1 wherein the remediation instruction in step (e) is sent to the mobile communication device only if the data object is determined to be present on the mobile communication device. ### Claim 18 (depends on 1) The method of claim 1 wherein the remediation instruction in step (e) is an instruction to uninstall the data object. ### Claim 19 A non-transitory computer readable storage medium for use with a server computer to re-assess a data object, the non-transitory computer readable storage medium containing computer readable instructions, which when executed by a processor cause the processor to perform the steps of a method comprising: a) at the server computer, receiving data about a data object residing on a mobile communication device, and storing the data in a data store accessible to the server computer; b) at the server computer, analyzing the data about the data object to produce a categorization assessment, and storing the categorization assessment in the data store accessible to the server computer; c) at the server computer, based upon a trigger selected from the group consisting of receipt of more data about the data object, receipt of more data about mobile communication devices, and an update to the server computer analyzing capability, re-analyzing the data about the data object; d) at the server computer, based upon the re-analyzing, producing an updated categorization assessment; and, e) at the server computer, sending a remediation instruction to the mobile communication device based upon the updated categorization assessment. ### Claim 20 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the data received in step (a) is binary data from the data object. ### Claim 21 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the data received in step (a) is metadata about the data object. ### Claim 22 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the data received in step (a) is behavioral data about the data object. ### Claim 23 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the analyzing in step (b) uses API analysis. ### Claim 24 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the analyzing in step (b) uses static analysis. ### Claim 25 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the analyzing in step (b) uses dynamic analysis. ### Claim 26 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the analyzing in step (b) uses behavioral analysis. ### Claim 27 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the analyzing in step (b) uses code path analysis. ### Claim 28 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the re-analyzing in step (c) uses API analysis. ### Claim 29 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the re-analyzing in step (c) uses static analysis. ### Claim 30 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the re-analyzing in step (c) uses dynamic analysis. ### Claim 31 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the re-analyzing in step (c) uses behavioral analysis. ### Claim 32 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the re-analyzing in step (c) uses code path analysis. ### Claim 33 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the sending a remediation instruction in step (e) includes an action of instructing a software application on the mobile communication device. ### Claim 34 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the sending a remediation instruction in step (e) includes sending a message to a user via a messaging system. ### Claim 35 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the remediation instruction in step (e) is sent to the mobile communication device only if the data object is determined to be present on the mobile communication device. ### Claim 36 (depends on 19) The non-transitory computer readable storage medium of claim 19 wherein the remediation instruction in step (e) is an instruction to uninstall the data object.