# US 9,438,631 B2 · Off-device anti-malware protection for mobile devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,631 B2 - Document ID: US9438631B2 - Status: Granted - Kind: B2 - Application number: 14/541,007 - Filed: 2014-11-13 - Published: 2015-05-21 - Granted: 2016-09-06 - Earliest claimed: 2012-02-24 - Assignees: Appthority, Inc. - Applicants: Appthority, Inc. - Inventors: Anthony John Bettini; Kevin Watkins; Domingo J. Guerra; Michael Price - Web page: https://patentgrep.com/patent/US9438631B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/568: {eliminating virus, restoring damaged files} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04W 4/50: Service provisioning or reconfiguring - H04W 4/60: Subscription-based services using application servers or record carriers, e.g. SIM application toolkits - H04W 12/12: Detection or prevention of fraud - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Techniques for off-device anti-malware protection for mobile devices are disclosed. In some embodiments, off-device anti-malware protection for mobile devices includes receiving a software inventory for a mobile device, in which the software inventory identifies a plurality of applications installed on the mobile device; and determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on a policy. In some embodiments, the off-device anti-malware protection for mobile devices further includes enforcing the policy on the mobile device. In some embodiments, the off-device anti-malware protection for mobile devices is provided as a cloud service. ## Claims ### Claim 1 A system for off-device anti-malware protection for mobile devices, comprising: a processor configured to: receive a software inventory for a mobile device, wherein the software inventory identifies a plurality of applications installed on the mobile device; determine whether one or more of the plurality of applications identified in the software inventory are associated with malware based on an enterprise policy that includes custom rules for scanning of apps based on security requirements for scanning apps for risk assessment, wherein the enterprise policy includes a security policy for scanning apps for risk assessment, wherein the determining of whether the one or more of the plurality of applications identified in the software inventory are associated with the malware comprises to: perform the following: determine whether the one or more of the plurality of applications track a location of the mobile device and a user of the mobile device has a predetermined position or job; in the event that the one or more of the plurality of applications track the location of the mobile device and the user of the mobile device has the predetermined position or job, determine that the one or more of the plurality of applications are associated with malware; determine whether the one or more of the plurality of applications use encryption for secure communications or client-side encryption for cloud based storage services; and in the event that the one or more of the plurality of applications do not use encryption for secure communications or client-side encryption for cloud based storage services, determine that the one or more of the plurality of applications are associated with malware; and send results of determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on the enterprise policy to a mobile device management (MDM) service, wherein the MDM service enforces the enterprise policy by uninstalling one or more applications on the mobile device that were identified as being associated with malware based on the enterprise policy; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, wherein the MDM provisioning profile periodically generates an updated software inventory for the mobile device, wherein the mobile device periodically synchronizes with the MDM service to provide an updated software inventory for the mobile device, and wherein the periodically updated software inventory for the mobile device is communicated from the MDM service to a cloud service for providing off-device anti-malware protection for mobile devices. ### Claim 3 (depends on 1) The system recited in claim 1, wherein a certificate is installed on the mobile device, and wherein the certificate is used to generate the software inventory that is communicated to a service for providing off-device anti-malware protection for mobile devices. ### Claim 4 (depends on 1) The system recited in claim 1, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, wherein the MDM provisioning profile periodically generates an updated software inventory for the mobile device, and wherein the periodically updated software inventory for the mobile device is communicated to a cloud service to update mobile app meta data for the mobile device stored in an MDM catalog. ### Claim 5 (depends on 1) The system recited in claim 1, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, and wherein the MDM provisioning profile generates the software inventory for the mobile device. ### Claim 6 (depends on 1) The system recited in claim 1, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, wherein the MDM provisioning profile periodically generates an updated software inventory for the mobile device, and wherein the periodically updated software inventory for the mobile device is communicated to a cloud service for providing off-device anti-malware protection for mobile devices. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the software inventory for the mobile device is received at a cloud service for providing off-device anti-malware protection for mobile devices. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the enterprise policy includes one or more of the following: a malware policy, a privacy policy, and an enterprise configured application security policy. ### Claim 9 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: determine an application is in violation of one or more aspects of the enterprise policy. ### Claim 10 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: determine an application is risky based on the enterprise policy. ### Claim 11 (depends on 1) The system recited in claim 1, wherein the determining of whether the one or more of the plurality of applications identified in the software inventory are associated with malware comprises to: perform a static analysis on an app including to extract method and function names called by the app; and perform a dynamic analysis on the extracted method and function names called by the app to determine whether a scope of authorization or a proper user permission is exceeded during execution. ### Claim 12 (depends on 1) The system recited in claim 1, wherein the determining of whether the one or more of the plurality of applications identified in the software inventory are associated with the malware further comprises to: determine whether the one or more of the plurality of applications export contact information of the mobile device; in the event that the one or more of the plurality of applications export contact information of the mobile device, determine that the one or more of the plurality of applications are associated with malware; determine whether the one or more of the plurality of applications use power of the mobile device above a predetermined threshold; in the event that the one or more of the plurality of applications use power of the mobile device above the predetermined threshold, determine that the one or more of the plurality of applications are associated with malware; determine whether the one or more of the plurality of applications use data above another predetermined threshold; and in the event that the one or more of the plurality of applications use data above the other predetermined threshold, determine that the one or more of the plurality of applications are associated with malware. ### Claim 13 A method for off-device anti-malware protection for mobile devices, comprising: receiving a software inventory for a mobile device, wherein the software inventory identifies a plurality of applications installed on the mobile device; determining whether one or more of the plurality of applications identified in the software inventory are associated with malware using a processor based on an enterprise policy that includes custom rules for scanning of apps based on security requirements for scanning apps for risk assessment, wherein the enterprise policy includes a security policy for scanning apps for risk assessment, wherein the determining of whether the one or more of the plurality of applications identified in the software inventory are associated with the malware comprises: performing the following: determining whether the one or more of the plurality of applications track a location of the mobile device and a user of the mobile device has a predetermined position or job; in the event that the one or more of the plurality of applications track the location of the mobile device and the user of the mobile device has the predetermined position or job, determining that the one or more of the plurality of applications are associated with malware; determining whether the one or more of the plurality of applications use encryption for secure communications or client-side encryption for cloud based storage services; and in the event that the one or more of the plurality of applications do not use encryption for secure communications or client-side encryption for cloud based storage services, determining that the one or more of the plurality of applications are associated with malware; and sending results of determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on the enterprise policy to a mobile device management (MDM) service, wherein the MDM service enforces the enterprise policy by uninstalling one or more applications on the mobile device that were identified as being associated with malware based on the enterprise policy. ### Claim 14 (depends on 13) The method of claim 13, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, wherein the MDM provisioning profile periodically generates an updated software inventory for the mobile device, wherein the mobile device periodically synchronizes with the MDM service to provide an updated software inventory for the mobile device, and wherein the periodically updated software inventory for the mobile device is communicated from the MDM service to a cloud service for providing off-device anti-malware protection for mobile devices. ### Claim 15 (depends on 13) The method of claim 13, wherein a certificate is installed on the mobile device, and wherein the certificate is used to generate the software inventory that is communicated to a service for providing off-device anti-malware protection for mobile devices. ### Claim 16 (depends on 13) The method of claim 13, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, wherein the MDM provisioning profile periodically generates an updated software inventory for the mobile device, and wherein the periodically updated software inventory for the mobile device is communicated to a cloud service to update mobile app meta data for the mobile device stored in an MDM catalog. ### Claim 17 (depends on 13) The method of claim 13, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, and wherein the MDM provisioning profile generates the software inventory for the mobile device. ### Claim 18 (depends on 13) The method of claim 13, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, wherein the MDM provisioning profile periodically generates an updated software inventory for the mobile device, and wherein the periodically updated software inventory for the mobile device is communicated to a cloud service for providing off-device anti-malware protection for mobile devices. ### Claim 19 (depends on 13) The method of claim 13, wherein the software inventory for the mobile device is received at a cloud service for providing off-device anti-malware protection for mobile devices. ### Claim 20 (depends on 13) The method of claim 13, further comprising: determining an application is in violation of one or more aspects of the enterprise policy. ### Claim 21 (depends on 13) The method of claim 13, further comprising: determining an application is risky based on the enterprise policy. ### Claim 22 A computer program product for off-device anti-malware protection for mobile devices, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for: receiving a software inventory for a mobile device, wherein the software inventory identifies a plurality of applications installed on the mobile device; determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on an enterprise policy that includes custom rules for scanning of apps based on security requirements for scanning apps for risk assessment, wherein the enterprise policy includes a security policy for scanning apps for risk assessment, wherein the determining of whether the one or more of the plurality of applications identified in the software inventory are associated with the malware comprises: performing the following: determining whether the one or more of the plurality of applications track a location of the mobile device and a user of the mobile device has a predetermined position or job; in the event that the one or more of the plurality of applications track the location of the mobile device and the user of the mobile device has the predetermined position or job, determining that the one or more of the plurality of applications are associated with malware; determining whether the one or more of the plurality of applications use encryption for secure communications or client-side encryption for cloud based storage services; and in the event that the one or more of the plurality of applications do not use encryption for secure communications or client-side encryption for cloud based storage services, determining that the one or more of the plurality of applications are associated with malware; and sending results of determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on the enterprise policy to a mobile device management (MDM) service, wherein the MDM service enforces the enterprise policy by uninstalling one or more applications on the mobile device that were identified as being associated with malware based on the enterprise policy. ### Claim 23 (depends on 22) The computer program product recited in claim 22, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, wherein the MDM provisioning profile periodically generates an updated software inventory for the mobile device, wherein the mobile device periodically synchronizes with the MDM service to provide an updated software inventory for the mobile device, and wherein the periodically updated software inventory for the mobile device is communicated from the MDM service to a cloud service for providing off-device anti-malware protection for mobile devices. ### Claim 24 (depends on 22) The computer program product recited in claim 22, wherein a certificate is installed on the mobile device, and wherein the certificate is used to generate the software inventory that is communicated to a service for providing off-device anti-malware protection for mobile devices. ### Claim 25 (depends on 22) The computer program product recited in claim 22, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, wherein the MDM provisioning profile periodically generates an updated software inventory for the mobile device, and wherein the periodically updated software inventory for the mobile device is communicated to a cloud service to update mobile app meta data for the mobile device stored in an MDM catalog. ### Claim 26 (depends on 22) The computer program product recited in claim 22, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, and wherein the MDM provisioning profile generates the software inventory for the mobile device. ### Claim 27 (depends on 22) The computer program product recited in claim 22, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, wherein the MDM provisioning profile periodically generates an updated software inventory for the mobile device, and wherein the periodically updated software inventory for the mobile device is communicated to a cloud service for providing off-device anti-malware protection for mobile devices. ### Claim 28 (depends on 22) The computer program product recited in claim 22, wherein the software inventory for the mobile device is received at a cloud service for providing off-device anti-malware protection for mobile devices. ### Claim 29 (depends on 22) The computer program product recited in claim 22, further comprising computer instructions for: determining an application is in violation of one or more aspects of the enterprise policy. ### Claim 30 (depends on 22) The computer program product recited in claim 22, further comprising computer instructions for: determining an application is risky based on the enterprise policy. ### Claim 31 A system for off-device anti-malware protection for mobile devices, comprising: a processor configured to: automatically analyze a plurality of applications for a mobile device platform to determine whether any of the plurality of applications violates an enterprise policy that includes custom rules for scanning of apps based on security requirements, wherein the automatically analyzing of the plurality of applications for a mobile device platform to determine whether any of the plurality of applications violates an enterprise policy comprises to: perform the following: determine whether the one or more of the plurality of applications track a location of the mobile device and a user of the mobile device has a predetermined position or job; in the event that the one or more of the plurality of applications track the location of the mobile device and the user of the mobile device has the predetermined position or job, determine that the one or more of the plurality of applications are associated with malware; determine whether the one or more of the plurality of applications use encryption for secure communications or client-side encryption for cloud based storage services; and in the event that the one or more of the plurality of applications do not use encryption for secure communications or client-side encryption for cloud based storage services, determine that the one or more of the plurality of applications are associated with malware; generate a data feed identifying one or more of the plurality of applications that were determined to be associated with malware based on the enterprise policy for scanning apps for risk assessment, wherein the enterprise policy includes a security policy for scanning apps for risk assessment; and send the data feed to a mobile device management (MDM) service of an enterprise subscriber for enforcing the enterprise policy associated with the enterprise subscriber on a plurality of mobile devices managed by the MDM service; and a memory coupled to the processor and configured to provide the processor with instructions.