Systems and methods for application security analysis

• US 10,097,576 B2
• Filed: 03/24/2018
• Issued: 10/09/2018
• Est. Priority Date: 10/21/2014
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Proofpoint Incorporated
• Inventors: Jevans, David Alexander, Basandra, Suresh Kumar
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US15/934,951
• Publication Number:
  US 20180227323A1
• Time in Patent Office: 199 Days
• Field of Search: None
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Systems and methods for analyzing applications for risk are provided. In an example method, the applications reside on a mobile device that is configurable to access an enterprise system. The example method includes evaluating each of a plurality of applications variously for privacy, data leakage, and malicious behavior. The example method also includes calculating a risk score for each of the plurality of applications based on the evaluating; and automatically remediating (e.g., quarantining) the applications, of the plurality of applications, for which the risk score meets or exceeds a risk score threshold. The method may evaluate all of the applications residing on a mobile device. The method may include grouping application behaviors, for each of the applications, that indicate an increased risk into groups comprising two or more of privacy risk, a data leakage risk, an account takeover risk, a device takeover risk, and a malware risk.

Claims

1. A method, comprising:

evaluating each of a plurality of applications for each of privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior, the plurality of applications residing on a mobile device, the mobile device being configurable to access an enterprise system, the evaluating comprising;

performing a static analysis of each of the plurality of applications for each of the privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior;

performing a dynamic analysis of each of the plurality of applications for each of the privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior; and

performing a behavior analysis of each of the plurality of applications for each of the privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior;

based on the static analysis, dynamic analysis, and behavior analysis, calculating a score for each of the plurality of applications;

determining whether each of the plurality of applications meets or exceeds a score threshold; and

automatically remediating each of the applications, of the plurality of applications, for which the score meets or exceeds the score threshold.

2. The method of claim 1, wherein the evaluating is performed on the mobile device.

3. The method of claim 1, wherein the evaluating is performed in a virtual environment.

4. The method of claim 1, wherein the evaluating further comprises:

performing a static analysis of each of the plurality of applications for device takeover behavior;

performing a dynamic analysis of each of the plurality of applications for the device takeover behavior; and

performing a behavior analysis of each of the plurality of applications for the device takeover behavior.

5. The method of claim 1, wherein the static analysis comprises analyzing declared permissions of each of the plurality of applications in comparison with actual resources of the mobile device that are utilized by the respective application.

6. The method of claim 1, wherein the dynamic analysis comprises executing each of a plurality of applications in a virtual environment and further comprises analyzing application behaviors for each of a plurality of applications over a period of time.

7. The method of claim 1, wherein the behavior analysis comprises executing each of the plurality of applications in a virtual environment and monitoring input and output operations of the respective applications.

8. The method of claim 1, wherein the calculating the score for each of the plurality of applications further comprises calculating a resource score that is indicative of a reputation of network resources utilized by each of the plurality of applications.

9. The method of claim 8, wherein the calculating the score for each of the plurality of applications further comprises determining if the respective application encrypts data transmitted to the network resources.

10. The method of claim 1, wherein the evaluating further comprises:

for the plurality of applications, grouping application behaviors that indicate an increased risk into groups comprising a privacy risk, a data leakage risk, an account takeover risk, and a malware risk.

11. The method of claim 10, wherein the privacy risk for an application of the plurality of applications comprises a risk of applications of any transmission of sensitive information regarding a user over a network.

12. The method of claim 10, wherein the data leakage risk for an application of the plurality of applications comprises any transmission of unencrypted data by the application, any connection to a file sharing service by the application, and any uploading of data to an untrusted service.

13. The method of claim 10, wherein the malware risk for an application of the plurality of applications comprises any activity performed by the application that is indicative of malicious behavior by the application of a network resource accessed by the application.

14. The method of claim 10, wherein the account takeover risk for an application of the plurality of applications comprises any transmission of authentication credentials to a network resource by the application, accessing an online account associated with a user of the mobile device in an unauthorized way, or accessing an online account not associated with the user of the mobile device or not authorized for the application.

15. The method of claim 10, wherein the groups further comprise a device takeover risk.

16. The method of claim 15, wherein the device takeover risk for an application of the plurality of applications comprises one or more of:

any transmission of hardware identification information by the application, a violation of a policy for accessing a restricted application programming interface (API), and a jailbreak or rooting attempt by the application.

17. The method of claim 1, wherein the evaluating further comprises:

for the plurality of applications, grouping application behaviors that indicate an increased risk into groups comprising a privacy risk, a data leakage risk, an account takeover risk, and a malware risk;

wherein the malware risk for an application of the plurality of applications comprises any activity performed by the application that is indicative of malicious behavior by the application of a network resource accessed by the application.

18. The method of claim 1, further comprising comparing each of the plurality of applications to a blacklist of applications, wherein, if at least one of the application and an application developer of the application is listed on the blacklist, the respective application is automatically remediated.

19. A mobile device management system, comprising:

one or more enterprise devices that provide enterprise services; and

an application analysis system, comprising a processor that executes instructions stored in memory to;

detect mobile devices attempting to access the enterprise services; and

conduct an analysis of a plurality of applications residing on the mobile devices, the mobile devices being configurable to access an enterprise system, the analysis comprising;

comparing the plurality of applications to a whitelist and blacklist;

for each of the plurality of applications not on the whitelist or blacklist, evaluating each of the plurality of applications for each of privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior, the evaluating comprising performing a static, dynamic, and behavior analysis of each of the plurality of applications for each of the privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior;

calculating a score for each of the plurality of applications based on the application behaviors; and

automatically remediating respective applications of the plurality of applications if the score calculated for the respective applications meets or exceeds a score threshold.

20. A non-transitory computer-readable storage medium having embodied thereon instructions, which, when executed by at least one processor, perform steps of a method, the method comprising:

evaluating each of a plurality of applications for each of privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior, the plurality of applications residing on a mobile device, the mobile device being configurable to access an enterprise system, the evaluating comprising;

performing a static analysis of each of the plurality of applications for each of the privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior;

performing a dynamic analysis of each of the plurality of applications for each of the privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior; and

performing a behavior analysis of each of the plurality of applications for each of the privacy behavior, data leakage behavior, account takeover behavior, and malicious behavior;

based on the static analysis, dynamic analysis, and behavior analysis, calculating a score for each of the plurality of applications;

determining whether each of the plurality of applications meets or exceeds a score threshold; and

automatically remediating the applications, of the plurality of applications, for which the score meets or exceeds the score threshold.