# US 8,752,176 B2 · System and method for server-coupled application re-analysis to obtain trust, distribution and ratings assessment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,176 B2 - Document ID: US8752176B2 - Status: Granted - Kind: B2 - Application number: 13/461,984 - Filed: 2012-05-02 - Published: 2012-09-13 - Granted: 2014-06-10 - Earliest claimed: 2008-10-21 - Assignees: Lookout, Inc. - Applicants: Kevin Patrick Mahaffey; James David Burgess; David Golombek; Timothy Micheal Wyatt; Anthony McKay Lineberry; Kyle Barton; Daniel Lee Evans; David Luke Richardson; Ariel Salomon - Inventors: Kevin Patrick Mahaffey; James David Burgess; David Golombek; Timothy Micheal Wyatt; Anthony McKay Lineberry; Kyle Barton; Daniel Lee Evans; David Luke Richardson; Ariel Salomon - Web page: https://patentgrep.com/patent/US8752176B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/564: {by virus signature recognition} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 63/1433: {Vulnerability analysis} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for preventing malware, spyware and other undesirable applications from affecting mobile communication devices uses a server to assist in identifying and removing undesirable applications. When scanning an application, a device transmits information about the application to a server for analysis. The server receives the information, produces a characterization assessment and can also provide a characterization re-assessment for the application, or data object, and transmits the assessment to the device. By performing analysis on a server, the invention allows a device to reduce the battery and performance cost of protecting against undesirable applications. The server transmits notifications to devices that have installed applications that are discovered to be undesirable. The server can accumulate this data and then perform a characterization re-assessment of a data object it has previously assessed to provide an assessment based upon one of trust, distribution and ratings information. ## Claims ### Claim 1 A method for re-assessing a data object by a server computer comprising: a) at the server computer, receiving data about a data object residing on a mobile communication device, and storing the data in a data store accessible to the server computer; b) at the server computer, analyzing the data about the data object to produce a trust assessment, and storing the trust assessment in the data store accessible to the server computer; c) at the server computer, based upon a trigger selected from the group consisting of receipt of more data about the data object, receipt of more data about mobile communication devices, and an update to the server computer analyzing capability, re-analyzing the data about the data object; d) at the server computer, based upon the re-analyzing, producing an updated trust assessment; and, e) at the server computer, sending a remediation instruction to the mobile communication device based upon the updated trust assessment. ### Claim 2 (depends on 1) The method of claim 1 wherein the data received in step (a) is binary data from the data object. ### Claim 3 (depends on 1) The method of claim 1 wherein the data received in step (a) is metadata about the data object. ### Claim 4 (depends on 1) The method of claim 1 wherein the data received in step (a) is behavioral data about the data object. ### Claim 5 (depends on 1) The method of claim 1 wherein the analyzing in step (b) uses API analysis. ### Claim 6 (depends on 1) The method of claim 1 wherein the analyzing in step (b) uses static analysis. ### Claim 7 (depends on 1) The method of claim 1 wherein the analyzing in step (b) uses dynamic analysis. ### Claim 8 (depends on 1) The method of claim 1 wherein the analyzing in step (b) uses behavioral analysis. ### Claim 9 (depends on 1) The method of claim 1 wherein the analyzing in step (b) uses code path analysis. ### Claim 10 (depends on 1) The method of claim 1 wherein the re-analyzing in step (c) uses API analysis. ### Claim 11 (depends on 1) The method of claim 1 wherein the re-analyzing in step (c) uses static analysis. ### Claim 12 (depends on 1) The method of claim 1 wherein the re-analyzing in step (c) uses dynamic analysis. ### Claim 13 (depends on 1) The method of claim 1 wherein the re-analyzing in step (c) uses behavioral analysis. ### Claim 14 (depends on 1) The method of claim 1 wherein the re-analyzing in step (c) uses code path analysis. ### Claim 15 (depends on 1) The method of claim 1 wherein the sending a remediation instruction in step (e) includes an action of instructing a software application on the mobile communication device. ### Claim 16 (depends on 1) The method of claim 1 wherein the sending a remediation instruction in step (e) includes sending a message to a user via a messaging system. ### Claim 17 (depends on 1) The method of claim 1 wherein the remediation instruction in step (e) is sent to the mobile communication device only if the data object is determined to be present on the mobile communication device. ### Claim 18 (depends on 1) The method of claim 1 wherein the remediation instruction in step (e) is an instruction to uninstall the data object. ### Claim 19 A method for re-assessing a data object by a server computer comprising: a) at the server computer, receiving data about a data object residing on a mobile communication device, and storing the data in a data store accessible to the server computer; b) at the server computer, analyzing the data about the data object to produce a distribution assessment, and storing the distribution assessment in the data store accessible to the server computer; c) at the server computer, based upon a trigger selected from the group consisting of receipt of more data about the data object, receipt of more data about mobile communication devices, and an update to the server computer analyzing capability, re-analyzing the data about the data object; d) at the server computer, based upon the re-analyzing, producing an updated distribution assessment; and, e) at the server computer, sending a remediation instruction to the mobile communication device based upon the updated distribution assessment. ### Claim 20 (depends on 19) The method of claim 19 wherein the data received in step (a) is binary data from the data object. ### Claim 21 (depends on 19) The method of claim 19 wherein the data received in step (a) is metadata about the data object. ### Claim 22 (depends on 19) The method of claim 19 wherein the data received in step (a) is behavioral data about the data object. ### Claim 23 (depends on 19) The method of claim 19 wherein the analyzing in step (b) uses API analysis. ### Claim 24 (depends on 19) The method of claim 19 wherein the analyzing in step (b) uses static analysis. ### Claim 25 (depends on 19) The method of claim 19 wherein the analyzing in step (b) uses dynamic analysis. ### Claim 26 (depends on 19) The method of claim 19 wherein the analyzing in step (b) uses behavioral analysis. ### Claim 27 (depends on 19) The method of claim 19 wherein the analyzing step in (b) uses code path analysis. ### Claim 28 (depends on 19) The method of claim 19 wherein the re-analyzing in step (c) uses API analysis. ### Claim 29 (depends on 19) The method of claim 19 wherein the re-analyzing in step (c) uses static analysis. ### Claim 30 (depends on 19) The method of claim 19 wherein the re-analyzing in step (c) uses dynamic analysis. ### Claim 31 (depends on 19) The method of claim 19 wherein the re-analyzing in step (c) uses behavioral analysis. ### Claim 32 (depends on 19) The method of claim 19 wherein the re-analyzing in step (c) uses code path analysis. ### Claim 33 (depends on 19) The method of claim 19 wherein the sending a remediation instruction in step (e) includes an action of instructing a software application on the mobile communication device. ### Claim 34 (depends on 19) The method of claim 19 wherein the sending a remediation instruction in step (e) includes sending a message to a user via a messaging system. ### Claim 35 (depends on 19) The method of claim 19 wherein the remediation instruction in step (e) is sent to the mobile communication device only if the data object is determined to be present on the mobile communication device. ### Claim 36 (depends on 19) The method of claim 19 wherein the remediation instruction in step (e) is an instruction to uninstall the data object. ### Claim 37 A method for re-assessing a data object by a server computer comprising: a) at the server computer, receiving data about a data object residing on a mobile communication device, and storing the data in a data store accessible to the server computer; b) at the server computer, analyzing the data about the data object to produce a ratings assessment, and storing the ratings assessment in the data store accessible to the server computer; c) at the server computer, based upon a trigger selected from the group consisting of receipt of more data about the data object, receipt of more data about mobile communication devices, and an update to the server computer analyzing capability, re-analyzing the data about the data object; d) at the server computer, based upon the re-analyzing, producing an updated ratings assessment; and, e) at the server computer, sending a remediation instruction to the mobile communication device based upon the updated ratings assessment. ### Claim 38 (depends on 37) The method of claim 37 wherein the data received in step (a) is binary data from the data object. ### Claim 39 (depends on 37) The method of claim 37 wherein the data received in step (a) is metadata about the data object. ### Claim 40 (depends on 37) The method of claim 37 wherein the data received in step (a) is behavioral data about the data object. ### Claim 41 (depends on 37) The method of claim 37 wherein the analyzing in step (b) uses API analysis. ### Claim 42 (depends on 37) The method of claim 37 wherein the analyzing in step (b) uses static analysis. ### Claim 43 (depends on 37) The method of claim 37 wherein the analyzing in step (b) uses dynamic analysis. ### Claim 44 (depends on 37) The method of claim 37 wherein the analyzing in step (b) uses behavioral analysis. ### Claim 45 (depends on 37) The method of claim 37 wherein the analyzing in step (b) uses code path analysis. ### Claim 46 (depends on 37) The method of claim 37 wherein the re-analyzing in step (c) uses API analysis. ### Claim 47 (depends on 37) The method of claim 37 wherein the re-analyzing in step (c) uses static analysis. ### Claim 48 (depends on 37) The method of claim 37 wherein the re-analyzing in step (c) uses dynamic analysis. ### Claim 49 (depends on 37) The method of claim 37 wherein the re-analyzing in step (c) uses behavioral analysis. ### Claim 50 (depends on 37) The method of claim 37 wherein the re-analyzing in step (c) uses code path analysis. ### Claim 51 (depends on 37) The method of claim 37 wherein the sending a remediation instruction in step (e) includes an action of instructing a software application on the mobile communication device. ### Claim 52 (depends on 37) The method of claim 37 wherein the sending a remediation instruction in step (e) includes an action of sending a message to a user via a messaging system. ### Claim 53 (depends on 37) The method of claim 37 wherein the remediation instruction in step (e) is sent to the mobile communication device only if the data object is determined to be present on the mobile communication device. ### Claim 54 (depends on 37) The method of claim 37 wherein the remediation instruction in step (e) is an instruction to uninstall the data object.