Mobile application management

• US 10,114,950 B2
• Filed: 07/18/2017
• Issued: 10/30/2018
• Est. Priority Date: 10/19/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Nalluri, Srikanth, Kulkarni, Dattatraya, Sinha, Raja, Krishnapur, Venkatasubrahmanyam, Dhruw, Kaushal Kumar, Halder, Kamlesh
• Primary Examiner(s): Li, Meng
• Application Number:
  US15/652,623
• Publication Number:
  US 20180089431A1
• Time in Patent Office: 469 Days
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 8/436 Semantic checking

Abstract

Code of a particular application is analyzed against a semantic model of a software development kit of a particular platform. The semantic model associates a plurality of application behaviors with respective application programming interface (API) calls of the particular platform. A set of behaviors of the particular application is identified based on the analysis of the code and a particular one of the set of behaviors is identified as an undesired behavior. The particular application can be automatically modified to remediate the undesired behavior. The particular application can be assigned to one of a plurality of device modes, and access to the particular application on a user device can be based on which of the plurality of device modes is active on the user device.

Claims

1. At least one non-transitory machine readable storage medium having instructions stored thereon, the instructions when executed on at least one processor, cause the at least one processor to:

analyze code of a particular application against a machine-readable semantic model of a software development kit of a particular platform based on a request to download the particular application, wherein the machine-readable semantic model associates a plurality of application behaviors with respective application programming interface (API) calls of the particular platform and analysis of the code of the particular application comprises;

parsing the code to identify a subset of the API calls capable of being made by the particular application; and

identifying, from the machine-readable semantic model, a set of application behaviors of the particular application corresponding to the subset of the API calls, wherein the set of application behaviors describes functionality of the particular application;

identify data describing a prior user selection of a subset of the plurality of application behaviors, wherein the prior user selection defines a set of undesired behaviors to be associated with a particular user profile;

determine that a particular one of the set of application behaviors is an undesired behavior based on the prior user selection, wherein the particular one of the set of application behaviors corresponds to a particular one of the subset of the API calls;

autonomously modify, by the at least one processor, code of the particular application based on the machine-readable semantic model to remediate the undesired behavior and generate a custom version of the particular application, wherein modifying the code comprises replacing code of the particular API with code of another API; and

provide the custom version of the particular application for download by a device associated with the particular user profile in lieu of an unmodified version of the particular application.

2. The at least one non-transitory machine readable storage medium of claim 1, wherein determining that the particular one of the set of application behaviors is an undesired behavior includes comprises:

accessing rule data corresponding to a particular one of a plurality of computing devices; and

determining, from the rule data, that the one or more behaviors violate one or more rules.

3. The at least one non-transitory machine readable storage medium of claim 2, wherein the rules are associated with a particular user.

4. The at least one non-transitory machine readable storage medium of claim 3, wherein at least a portion of the rules include rules defined by the particular user.

5. The at least one non-transitory machine readable storage medium of claim 2, wherein the rules are associated with a network service provider.

6. The at least one non-transitory machine readable storage medium of claim 1, wherein the prior user selection is received in connection with a user interface displaying human readable descriptions of the plurality of application behaviors.

7. The at least one non-transitory machine readable storage medium of claim 6, wherein the human readable descriptions are generated using a template for generating the human readable descriptions and the machine-readable semantic model.

8. The at least one non-transitory machine readable storage medium of claim 1, wherein the particular application is to be executed on the device and the device is one of a smart phone and a tablet computing device.

9. A method comprising:

analyzing code of a particular software application against a semantic model of a software development kit of a particular platform based on a request to download the particular application, the semantic model associating a plurality of application behaviors with respective application programming interface (API) calls of the particular platform and analysis of the code of the particular software application comprises;

parsing the code to identify a subset of the API calls capable of being made by the particular software application; and

identifying, from the semantic model, a set of application behaviors of the particular software application corresponding to the subset of the API calls, wherein the set of application behaviors describes functionality of the particular software application;

identifying data describing a prior user selection of a subset of the plurality of application behaviors, wherein the prior user selection comprises a selection from a listing generated from the semantic model and the prior user selection defines a set of undesired behaviors to be associated with a particular user profile;

determining that a particular one of the set of application behaviors of the particular software application is an undesired behavior based on the prior user selection, wherein the particular one of the set of application behaviors corresponds to a particular one of the subset of the API calls;

autonomously modifying, by at least one processor, code of the software particular application based on the semantic model to remediate the undesired behavior and generate a custom version of the particular software application, wherein modifying the code comprises replacing code of the particular one of the subset of the API calls with code of another API; and

providing the custom version of the particular software application for download by a device associated with the particular user profile in lieu of an unmodified version of the particular software application.

10. The method of claim 9, further comprising disassembling the code of the particular software application into a control flow and generating a model of application logic for the particular software application based at least in part on the semantic model.

11. The method of claim 10, wherein the model of application logic is further based, at least in part, on ambient application knowledge.

12. The method of claim 9, further comprising performing a remediation action based on the identification that one or more of the set of application behaviors are undesired behaviors.

13. The method of claim 9, wherein the code of the particular software application is analyzed in connection with an attempt to implement the particular software application on the device.

14. The method of claim 13, further comprising restricting implementation of the unmodified version of the particular software application on the device based on determining that one or more of the set of application behaviors are undesired behaviors.

15. The method of claim 14, wherein restricting implementation includes blocking installation of the unmodified version of the particular software application on the device.

16. A system comprising:

at least one processor device;

at least one memory element; and

an application behavioral analysis engine, adapted when executed by the at least one processor device to;

analyze code of a particular application against a semantic model of a software development kit of a particular platform based on a request to download the particular application, wherein the semantic model associates a plurality of application behaviors with respective application programming interface (API) calls of the particular platform and analysis of the code of the particular application comprises;

parsing the code to identify a subset of the API calls capable of being made by the particular application; and

identifying, from the semantic model, a set of application behaviors of the particular application corresponding to the subset of the API calls, wherein the set of application behaviors describes functionality of the particular application;

identify data describing a prior user selection of a subset of the plurality of application behaviors, wherein the prior user selection comprises a selection from a listing generated from the semantic model and the prior user selection defines a set of undesired behaviors to be associated with a particular user profile; and

determine that a particular one of the set of application behaviors is an undesired behavior based on the prior user selection, wherein the particular one of the set of application behaviors corresponds to a particular one of the subset of the API calls;

autonomously modify, by the application behavioral analysis engine, code of the particular application based on the semantic model to remediate the undesired behavior and generate a custom version of the particular application, wherein modifying the code comprises replacing code of the particular API with code of another API; and

provide the custom version of the particular application for download by a device associated with the particular user profile in lieu of an unmodified version of the particular application.

17. The system of claim 16, further comprising a mode manager to:

activate a particular one of a plurality of modes defined for a user device; and

restrict access to the unmodified version of the particular application in accordance with the particular one of the plurality of modes that is activated, wherein the unmodified version of the particular application is made accessible when another one of the plurality of modes is activated.

18. The system of claim 16, further comprising the device, wherein the analysis of the code is performed based on an attempt by the device to install the particular application on the device.