Detection of rogue software applications
AssigneeAVG Netherlands B.V.
InventorsYuval Ben-Itzhak, Kaspars Osis, Mike Boz
Life of this patent
Estimating the term…
Abstract
Software applications are analyzed to determine if they are legitimate applications and warnings are provided to users to avoid installation and/or purchases of unnecessary and/or potentially harmful software based on comparisons of user-interface characteristics of the software applications to visual characteristics of authentic applications to determine to what extent they match (or do not match) or are attempting to mirror the legitimate application.
Claims20
A method for determining the legitimacy of a software application provided to a user of a computing device, the method comprising:
- programmatically detecting, using a processor of a computer device, that the software application is resident on the computing device;
- extracting, using the processor, visual user interface characteristics from at least one of an executable file and data files associated with the software application;
- collecting and storing the visual user interface characteristics of the software application in a memory;
- programmatically comparing the collected visual user interface characteristics to known visual user interface characteristics of at least one known legitimate software application;
- when a similarity between the collected visual user interface characteristics and the known visual user interface characteristics surpasses a predefined similarity threshold, analyzing at least one additional characteristic of the software application, wherein the at least one additional characteristic comprises a digital certificate;
- and
- terminating the software application and quarantining the files associated with the software application for subsequent deletion from the computing device when the at least one additional characteristic is indicative of rogue software.
A system for determining the legitimacy of a software application provided to a user of a computing device, the system comprising:
- at least one memory component for storing computer-executable instructions;
- and
- at least one processor configured to execute computer-executable instructions stored in the at least one memory component, which when executed:
- programmatically detect that the software application is resident on the computing device;
- extract visual user interface characteristics from at least one of an executable file and data files associated with the software application;
- collect and store visual user interface characteristics of the software application;
- programmatically compare the collected visual user interface characteristics to known visual user interface characteristics of at least one known legitimate software application;
- when a similarity between the collected visual user interface characteristics and the known visual user interface characteristics surpasses a predefined similarity threshold, analyze at least one additional characteristic of the software application, wherein the at least one additional characteristic comprises a permissions list of the software application;
- and
- terminate the software application and quarantine the files associated with the software application for subsequent deletion from the computing device when the at least one additional characteristic is indicative of rogue software.
A non-transitory program storage medium, comprising instructions encoded thereon that when executed by a computing device:
- detect that a software application is resident on the computing device;
- extract visual user interface characteristics from at least one of an executable file and data files associated with the software application;
- collect and store the visual user interface characteristics of the software application in a memory;
- compare the collected visual user interface characteristics to known visual user interface characteristics of at least one known legitimate software application;
- when a similarity between the collected visual user interface characteristics and the known visual user interface characteristics surpasses a predefined similarity threshold, analyze at least one additional characteristic of the software application, wherein the at least one additional characteristic comprises at least one of a digital certificate and a permissions list;
- and
- terminate the software application and quarantine the files associated with the software application for subsequent deletion from the computing device when the at least one additional characteristic is indicative of rogue software.
Dependencies are inferred from the claim text.