Techniques for identifying suspicious applications using requested permissions
AssigneeSymantec Corporation
InventorAnand Kashyap
Life of this patent
Estimating the term…
Abstract
Techniques for identifying suspicious applications are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for identifying suspicious applications comprising determining one or more clusters of applications in an identified category of applications based on requested permissions of each of two or more applications in each of the one or more clusters of applications, determining a center application of each of the one or more clusters, and determining, using at least one computer processor, a similarity score for an application being evaluated based at least in part on a distance between the application being evaluated and the center application of a closest cluster of the one or more clusters.
Claims19
A method for identifying suspicious applications comprising:
- determining one or more clusters of applications in an identified category of applications based on a distance metric measuring distances between requested permissions of each of two or more applications in each of the one or more clusters of applications;
- determining a center application of each of the one or more clusters;
- and
- determining, using at least one computer processor, a similarity score for an application being evaluated based at least in part on a distance between the application being evaluated and the center application of a closest cluster of the one or more clusters.
An article of manufacture for identifying suspicious applications, the article of manufacture comprising:
- at least one non-transitory processor readable storage medium;
- and
- instructions stored on the at least one storage medium;
- wherein the instructions are configured to be readable from the at least one storage medium by at least one processor and thereby cause the at least one processor to operate so as to:
- determine one or more clusters of applications in an identified category of applications based on a distance metric measuring distances between requested permissions of each of two or more applications in each of the one or more clusters of applications;
- determine a center application of each of the one or more clusters;
- and
- determine a similarity score for an application being evaluated based at least in part on a distance between the application being evaluated and the center application of a closest cluster of the one or more clusters.
A system for identifying suspicious applications comprising:
- one or more processors communicatively coupled to a network;
- wherein the one or more processors are configured to:
- determine one or more clusters of applications in an identified category of applications based on a distance metric measuring distances between requested permissions of each of two or more applications in each of the one or more clusters of applications;
- determine a center application of each of the one or more clusters;
- and
- determine a similarity score for an application being evaluated based at least in part on a distance between the application being evaluated and the center application of a closest cluster of the one or more clusters.
Dependencies are inferred from the claim text.