Back to results
US 8,713,684 B2Granted
Quantifying the risks of applications for mobile devices
AssigneeAppthority, Inc.
InventorsAnthony John Bettini, Kevin Watkins, Domingo J. Guerra, Michael Price
Life of this patent
Estimating the term…
Abstract
Quantifying the risks of applications (“apps”) for mobile devices is disclosed. In some embodiments, quantifying the risks of apps for mobile devices includes receiving an application for a mobile device; performing an automated analysis of the application based on a risk profile; and generating a risk score based on the automated analysis of the application based on the risk profile.
Claims26
A system for quantifying risks of applications (“apps”) for mobile devices, comprising:
- a processor configured to:
- receive an application for a mobile device;
- perform an automated analysis of the application based on a risk profile, wherein the risk profile is based on an enterprise policy that includes custom rules for scanning of apps based on security requirements;
- and
- generate a risk score based on the automated analysis of the application based on the risk profile, wherein the generation of the risk score comprises:
- check an application cache comprising:
- determine whether the application has been previously analyzed;
- and
- in the event that the application has been previously analyzed, return the previously determined risk score of the application;
- extract metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof;
- query public app market data relating to the application, the public app market data including application description, application ranking in a store, vendor reputation of the application, or any combination thereof;
- perform a disassembly/byte code pass comprising:
- determine whether the application performs a function based on an inspection of byte code or assembly language of the application, the function including sending text/SMS messages without user's permission, using GPS/location services without user's permission, or any combination thereof;
- or
- any combination thereof;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
14 more elements
A method of quantifying risks of applications (“apps”) for mobile devices, comprising:
- receiving an application for a mobile device;
- performing an automated analysis of the application based on a risk profile using a processor, wherein the risk profile is based on an enterprise policy that includes custom rules for scanning of apps based on security requirements;
- and
- generating a risk score based on the automated analysis of the application based on the risk profile, wherein the generation of the risk score comprises:
- checking an application cache comprising:
- determining whether the application has been previously analyzed;
- and
- in the event that the application has been previously analyzed, returning the previously determined risk score of the application;
- extracting metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof;
- querying public app market data relating to the application, the public app market data including application description, application ranking in a store, vendor reputation of the application, or any combination thereof;
- performing a disassembly/byte code pass comprising:
- determining whether the application performs a function based on an inspection of byte code or assembly language of the application, the function including sending text/SMS messages without user's permission, using GPS/location services without user's permission, or any combination thereof;
- or
- any combination thereof.
11 more elements
A computer program product for quantifying risks of applications (“apps”) for mobile devices, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- receiving an application for a mobile device;
- performing an automated analysis of the application based on a risk profile, wherein the risk profile is based on an enterprise policy that includes custom rules for scanning of apps based on security requirements;
- and
- generating a risk score based on the automated analysis of the application based on the risk profile, wherein the generation of the risk score comprises:
- checking an application cache comprising:
- determining whether the application has been previously analyzed;
- and
- in the event that the application has been previously analyzed, returning the previously determined risk score of the application;
- extracting metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof;
- querying public app market data relating to the application, the public app market data including application description, application ranking in a store, vendor reputation of the application, or any combination thereof
- performing a disassembly/byte code pass comprising:
- determining whether the application performs a function based on an inspection of byte code or assembly language of the application, the function including sending text/SMS messages without user's permission, using GPS/location services without user's permission, or any combination thereof;
- or
- any combination thereof.
11 more elements
Dependencies are inferred from the claim text.