Security, fraud detection, and fraud mitigation in device-assisted services systems

An end-user device, comprising:

• one or more modems for enabling the end-user device to communicate over at least a first wireless access network;
• memory configured to store:
• a first application program configured to execute on the end-user device and further configured to assist the end-user device in accessing one or more data services over at least the first wireless access network,
• a first application credential associated with the first application program,
• a first policy comprising one or more first policy instructions to be applied when the first application program initiates or attempts to initiate communication over the first wireless access network;
• and
• one or more device agents configured to:
• detect an attempted installation of update software on the end-user device, the update software purporting to be a modification, update, or replacement of the first application program,
• obtain an update-software credential associated with the update software,
• obtain the first application credential,
• determine whether the update-software credential matches the first application credential,
• when the update-software credential matches the first application credential, allow the update software to be installed on the end-user device,
• determine that the first application program is initiating or attempting to initiate communication over the first wireless access network, and
• based on the determination that the first application program is initiating or attempting to initiate communication over the first wireless access network, apply the first policy.