Mobile URL categorization

• US 10,079,876 B1
• Filed: 09/30/2014
• Issued: 09/18/2018
• Est. Priority Date: 09/30/2014
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Chung, Seokkyung, Rostamabadi, Farshad, Hewlett, William, Xu, Zhi, Rostami-Hesarsorkh, Shadi, Xu, Lin, Klarich, Lee
• Primary Examiner(s): Winder, Patrice L
• Assistant Examiner(s): Solomon, Ruth S.
• Application Number:
  US14/503,374
• Time in Patent Office: 1,449 Days
• Field of Search: 726 1, 726 3, 726 4, 726 17, 726 23, 726 12, 726 16, 726 25, 726 26, 726 22, 709203, 709217
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/35 Clustering; Classification
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/21 for social networking applications
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

Categorizing mobile uniform resource locators (URLs) used by a mobile application is disclosed. A plurality of URLs is extracted from the mobile application. A category is assigned to at least one URL included in the plurality of URLs. The category is assigned to the URL based on a categorization of the mobile application.

Claims

1. A system, comprising:

a set of one or more processors configured to;

extract a plurality of Uniform Resource Locators (URLs) from a mobile application, wherein extracting the plurality of URLs includes performing at least one of a static analysis and a dynamic analysis on the mobile application to determine a set of URLs used by the mobile application when executed, wherein the set of URLs includes at least one URL previously classified as being an infrastructure URL, and wherein the set of URLs separately includes at least one non-infrastructure URL;

determine that a first URL included in the set of URLs is a non-infrastructure URL;

assign a category to the first URL based on a categorization of the mobile application; and

generate as output the first URL and its assigned category; and

a memory coupled to the set of one or more processors and configured to provide the set of one or more processors with instructions.

2. The system of claim 1 wherein extracting the plurality of URLs includes determining one or more embedded URLs by performing static analysis on the mobile application.

3. The system of claim 1 wherein extracting the plurality of URLs includes determining one or more dynamically generated URLs by performing dynamic analysis on the mobile application.

4. The system of claim 1 wherein the set of one or more processors is further configured to categorize the mobile application.

5. The system of claim 4 wherein the mobile application is categorized at least in part by matching a keyword list against words extracted from the mobile application during static analysis.

6. The system of claim 4 wherein the mobile application is categorized at least in part based on performing an analysis on a textual description of the mobile application obtained from a mobile application store.

7. The system of claim 4 wherein the mobile application is categorized at least in part based on performing an analysis of information associated with a developer of the mobile application, wherein the information is obtained from a mobile application store.

8. The system of claim 4 wherein the mobile application is categorized at least in part based on performing a categorization analysis of applications designated as similar to the mobile application in a mobile application store.

9. The system of claim 1 wherein assigning the category includes assigning a severity level.

10. The system of claim 1 wherein the set of one or more processors is further configured to include the first URL in a training set.

11. A method, comprising:

extracting a plurality of Uniform Resource Locators (URLs) from a mobile application, wherein extracting the plurality of URLs includes performing at least one of a static analysis and a dynamic analysis on the mobile application to determine a set of URLs used by the mobile application when executed, wherein the set of URLs includes at least one URL previously classified as being an infrastructure URL, and wherein the set of URLs separately includes at least one non-infrastructure URLs;

determining that a first URL included in the set of URLs is a non-infrastructure URL;

assigning a category to the first URL based on a categorization of the mobile application; and

generating as output the first URL and its assigned category.

12. The method of claim 11 wherein extracting the plurality of URLs includes determining one or more embedded URLs by performing static analysis on the mobile application.

13. The method of claim 11 wherein extracting the plurality of URLs includes determining one or more dynamically generated URLs by performing dynamic analysis on the mobile application.

14. The method of claim 11 further comprising categorizing the mobile application.

15. The method of claim 14 wherein the mobile application is categorized at least in part by matching a keyword list against words extracted from the mobile application during static analysis.

16. The method of claim 14 wherein the mobile application is categorized at least in part based on performing an analysis on a textual description of the mobile application obtained from a mobile application store.

17. The method of claim 14 wherein the mobile application is categorized at least in part based on performing an analysis of information associated with a developer of the mobile application, wherein the information is obtained from a mobile application store.

18. The method of claim 14 wherein the mobile application is categorized at least in part based on performing a categorization analysis of applications designated as similar to the mobile application in a mobile application store.

19. The method of claim 11 wherein assigning the category includes assigning a severity level.

20. The method of claim 11 further comprising including the first URL in a training set.