Predictive scoring management system for application behavior

A system, comprising:

• one or more servers to:
• receive information regarding known epitypes of malness,
• wherein the information includes malness scores and behaviors for the known epitypes of malness,
• wherein the information includes values for setting a first threshold level and a second threshold level,
• and wherein the first threshold level and the second threshold level indicate values that are associated with malness scores that are not malness free values;
• store the information regarding the known epitypes of malness, and the information for setting the first threshold level and the second threshold level;
• generate rules for a model based on the information regarding the known epitypes of malness and information associated with a plurality of malness scores for different applications;
• input application data from an application on a device into the model;
• output a malness score for the application from the model based on the application data;
• allow the application or the device access to a network when the malness score for the application is below the first threshold level,
• block the application or the device access to the network when the malness score the application is above the second threshold level, where the first threshold level is less than the second threshold level, and
• transmit for further analysis information when the malness scores, for the application falls within a range that is between the first threshold level and the second threshold level.

A system, comprising:

• an epitype storage server that receives information regarding known epitypes of malness, where the epitype storage server stores the information regarding known epitypes of malness and information for setting a first threshold level and a second threshold level, where the information includes malness scores and behaviors for the known epitypes of malness, and where the first threshold level and second threshold level indicate malness scores that are not malness free values;
• a malness analysis server that builds a model based on the information regarding the known epitypes of malness stored by the epitype storage server and information associated with a plurality of malness scores for different applications;
• and
• a scoring engine server that uploads the model, and where the scoring engine server is further to:
• receive, from a device, applications data that corresponds to a plurality of applications, where the plurality of applications are included on a list for malness scoring,
• generate a malness score for each of the plurality of applications using the model and the applications data,
• allow access to a network for one or more of the plurality of applications or the device that includes the one or more of the plurality of applications when the malness scores for the one or more of the plurality of applications are below a first threshold level,
• block access to the network for the one or more of the plurality of applications or the device that includes the one or more of the plurality of applications when the malness score for the one or more of the plurality of applications is above a second threshold level, and where the first threshold level is less than the second threshold level, and
• transmit for further analysis information associated with the malness scores for one or more of the applications, when the malness scores falls within a range that is between the first threshold level and the second threshold level.