Using expectation measures to identify relevant application analysis results

At least one non-transitory computer readable medium for quantifying differences between detected behaviors of an application and expected behaviors of the application, in order to determine whether the application is suspect of being malicious, the at least one non-transitory computer readable medium storing program code that, when loaded into computer memory and executed by a processor performs the following steps:

• analyzing the application wherein the analyzing of the application detects application behaviors;
• mining data indicative of the functionality of the application from a plurality of sources;
• categorizing the application based on the mined data wherein the categorizing of the application indicates expected application behaviors;
• determining measures of consistency between the detected behaviors of the application and the expected behaviors of the application;
• and
• responsive to the determined measures of consistency, adjudicating whether the application is suspect of being malicious.

A computer system for quantifying differences between detected behaviors of an application and expected behaviors of the application, in order to determine whether the application is suspect of being malicious, the computer system comprising:

• computer memory;
• at least one processor;
• an application analyzing module residing in the computer memory, configured to analyze the application, wherein the analyzing of the application detects application behaviors;
• an application data mining module residing in the computer memory, configured to mine data indicative of the functionality of the application from a plurality of sources;
• an application categorizing module residing in the computer memory, configured to categorize the application based on the mined data wherein the categorizing of the application indicates expected application behaviors;
• a consistency determining module residing in the computer memory, configured to determine measures of consistency between the detected behaviors of the application and the expected behaviors of the application;
• and
• an application adjudicating module residing in the computer memory, configured to adjudicate whether the application is suspect of being malicious, responsive to the determined measures of consistency.