In-line filtering of insecure or unwanted mobile device software components or communications

A system for in-line filtering of applications for mobile devices, comprising:

• a hardware processor of an inline filtering device configured to:
• perform in-line filtering using the hardware processor of traffic from a mobile device to the Internet;
• identify an application request from the in-line filtering of traffic from the mobile device to the Internet, wherein the application request includes a request to download an application to the mobile device;
• quarantine the application at the inline filtering device until receipt of an acknowledgement of potential threats associated with the application are presented in a display on the mobile device, wherein the application is blocked from completing a transfer to the mobile device while it is quarantined at the inline filtering device, wherein the quarantining of the application comprises:
• perform an application analysis of the application based on a risk profile, wherein the risk profile is based on an application risk policy that includes custom rules for scanning of the application based on security requirements;
• generate a risk score based on the application analysis of the application based on the risk profile, wherein the generation of the risk score comprises:
• check an application cache comprising:
• determine whether the application has been previously analyzed;
• and
• in the event that the application has been previously analyzed, return the previously determined risk score of the application;
• extract metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof;
• query public application market data relating to the application, the public application market data including application description, application ranking in a store, vendor reputation of the application, or any combination thereof;
• and
• perform a disassembly/byte code pass comprising:
• determine whether the application performs a function based on an inspection of byte code or assembly language of the application, the function including sending text/SMS messages without user's permission, using GPS/location services without user's permission, or any combination thereof;
• and
• modify a response to the application request that is communicated to the mobile device using the hardware processor;
• and
• a memory coupled to the hardware processor and configured to provide the hardware processor with instructions.

A method of in-line filtering of applications for mobile devices, comprising:

• performing in-line filtering using a hardware processor of an inline filtering device of traffic from a mobile device to the Internet;
• identifying an application request from the in-line filtering of traffic from the mobile device to the Internet, wherein the application request includes a request to download an application to the mobile device;
• quarantining the application at the inline filtering device until receipt of an acknowledgement of potential threats associated with the application are presented in a display on the mobile device, wherein the application is blocked from completing a transfer to the mobile device while it is quarantined at the inline filtering device, wherein the quarantining of the application comprises:
• performing an application analysis of the application based on a risk profile, wherein the risk profile is based on an application risk policy that includes custom rules for scanning of the application based on security requirements;
• generating a risk score based on the application analysis of the application based on the risk profile, wherein the generation of the risk score comprises:
• checking an application cache comprising:
• determining whether the application has been previously analyzed;
• and
• in the event that the application has been previously analyzed, returning the previously determined risk score of the application;
• extracting metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof;
• querying public application market data relating to the application, the public application market data including application description, application ranking in a store, vendor reputation of the application, or any combination thereof;
• and
• performing a disassembly/byte code pass comprising:
• determining whether the application performs a function based on an inspection of byte code or assembly language of the application, the function including sending text/SMS messages without user's permission, using GPS/location services without user's permission, or any combination thereof;
• and
• modifying a response to the application request that is communicated to the mobile device.

A system for in-line filtering of insecure or unwanted mobile device communications for mobile devices, comprising:

• a hardware processor of an inline filtering device configured to:
• intercept a communication from a mobile device at an in-line filtering device;
• and
• determine whether the communication from the mobile device includes an insecure or unwanted mobile device communication using the hardware processor;
• throttle the communication at the inline filtering device until receipt of an acknowledgement of potential threats associated with the communication are presented in a display on the mobile device, wherein the communication is blocked from completing a transfer of a response to the communication to the mobile device while it is throttled at the inline filtering device, wherein the throttling of the communication comprises:
• perform an application analysis of the application based on a risk profile, wherein the risk profile is based on an application risk policy that includes custom rules for scanning of the application based on security requirements;
• generate a risk score based on the application analysis of the application based on the risk profile, wherein the generation of the risk score comprises:
• check an application cache comprising:
• determine whether the application has been previously analyzed;
• and
• in the event that the application has been previously analyzed, return the previously determined risk score of the application;
• extract metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof;
• query public application market data relating to the application, the public application market data including application description, application ranking in a store, vendor reputation of the application, or any combination thereof;
• and
• perform a disassembly/byte code pass comprising:
• determine whether the application performs a function based on an inspection of byte code or assembly language of the application, the function including sending text/SMS messages without user's permission, using GPS/location services without user's permission, or any combination thereof;
• and
• a memory coupled to the hardware processor and configured to provide the hardware processor with instructions.