Providing application-specific threat metrics

• US 10,291,641 B2
• Filed: 07/07/2017
• Issued: 05/14/2019
• Est. Priority Date: 12/01/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Desai, Vikas B., Hagemann, Carsten, Hockings, Christopher J., Johnston, Mark D.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US15/643,706
• Publication Number:
  US 20170310696A1
• Time in Patent Office: 676 Days
• Field of Search: 726 22- 26, 713188, 713194
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Assessment of threat risks associated with a given mobile device application (app) on a device type specific basis, so that the threat assessment is specific to a particular device type that is suitable for running the given app. The assessed device-type-specific risk is represented as device-type-specific risk metadata, which is associated as metadata with the given app. For example, the metadata may be stored along with the given app in a common repository that includes many apps. In some embodiments, the device-type-specific risk metadata is generated and stored comprehensively for all apps and device types used in an enterprise. The device-type-specific risk assessment, and corresponding device-type-specific risk metadata, may be based upon run time behavior of the given app on a given device type.

Claims

1. A method for use with a first mobile device application (first app) suitable for running on devices of at least a first device type, the method comprising:

collecting first-device-type risk-relevant data associated with a first app from a first plurality of devices, with each device of the first plurality of devices being of the first device type;

analyzing the first-device-type risk-relevant data to generate first-device-type risk characteristic data corresponding to the first device type;

associating the first-device-type risk characteristic data as first risk metadata with the first app;

collecting second-device-type risk-relevant data associated with the first app from a second plurality of devices, with each device of the second plurality of devices being of a second device type which is;

(i) suitable for running the first app, and (ii) different than the first device type;

analyzing the second-device-type risk-relevant data to generate second-device-type risk characteristic data corresponding to the second device type;

associating the second-device-type risk characteristic data as second risk metadata with the first app; and

selecting a first device for running the first app based on a device type of the first app and risk metadata of the first app associated with a device type of the first device.

2. The method according to claim 1 further comprising:

presenting, in human understandable form to a human user, the first risk metadata.

3. The method of claim 1 wherein the first-device-type risk-relevant data includes first-device-type run time behavioral data.