SYSTEM AND METHOD FOR SERVER-COUPLED APPLICATION RE-ANALYSIS

• US 20120290640A1
• Filed: 04/30/2012
• Published: 11/15/2012
• Est. Priority Date: 10/21/2008
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: MAHAFFEY, Kevin Patrick, BURGESS, James David, GOLOMBEK, David, LINEBERRY, Anthony McKay, BARTON, Kyle, EVANS, Daniel Lee, RICHARDSON, David Luke, SALOMON, Ariel, WYATT, Tomothy Michael
• Granted Patent: US 8,544,095 B2
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

To prevent malware, spyware and other undesirable applications from affecting mobile communication devices (e.g., smartphones, netbooks, and tablets), a device uses a server to assist in identifying and removing undesirable applications. When scanning an application, a device transmits information about the application to a server for analysis. The server receives the information, produces a categorization assessment and can provide a categorization re-assessment, and transmits the assessment to the device. By performing analysis on a server, a device can reduce its battery and performance cost of protecting against undesirable applications. The server transmits notifications to devices that have installed applications that are discovered to be undesirable. The server receives data about applications from many devices, using the combined data to minimize false positives and provide comprehensive protection against known and unknown threats. The server can accumulate this data and perform a categorization re-assessment of a data object previously assessed.

Claims

1. A method for re-assessing a data object by a server computer comprising:

a) at the server computer, receiving data about a data object accessible to a mobile communication device, and storing the data in a data store accessible to the server computer;

b) at the server computer, analyzing the data about the data object to produce a categorization assessment, and storing the categorization assessment in the data store accessible to the server computer;

c) at the server computer, based upon a trigger selected from the group consisting of receipt of more data about the data object, receipt of more data about mobile communication devices, and an update to the server computer analyzing capability, re-analyzing the data about the data object;

d) at the server, based upon the re-analyzing, producing an updated categorization assessment; and

,

e) at the server, sending a notification based upon the updated categorization assessment.

2. The method of claim 1 wherein the data received in step (a) is binary data from the data object.

3. The method of claim 1 wherein the data received in step (a) is metadata about the data object.

4. The method of claim 1 wherein the data received in step (a) is behavioral data about the data object.

5. The method of claim 1 wherein the analyzing step (b) uses API analysis.

6. The method of claim 1 wherein the analyzing step (b) uses static analysis.

7. The method of claim 1 wherein the analyzing step (b) uses dynamic analysis.

8. The method of claim 1 wherein the analyzing step (b) uses behavioral analysis.

9. The method of claim 1 wherein the analyzing step (b) uses code path analysis.

10. The method of claim 1 wherein the re-analyzing step (c) uses API analysis.

11. The method of claim 1 wherein the re-analyzing step (c) uses static analysis.

12. The method of claim 1 wherein the re-analyzing step (c) uses dynamic analysis.

13. The method of claim 1 wherein the re-analyzing step (c) uses behavioral analysis.

14. The method of claim 1 wherein the re-analyzing step (c) uses code path analysis.

15. The method of claim 1 wherein the sending a notification step (e) includes an action of notifying a software application on the mobile communication device.

16. The method of claim 1 wherein the sending a notification step (e) includes an action of notifying a use of the mobile communication device by sending a message to the user via a messaging system.

17. The method of claim 1 wherein the notification in step (e) is a warning.

18. The method of claim 1 wherein the notification in step (e) is an instruction to uninstall the data object.

19. A non-transitory computer readable storage medium for use with a server computer to re-assess a data object, the non-transitory computer readable storage medium containing computer readable instructions, which when executed by a processor cause the processor to perform the steps of a method comprising:

a) at the server computer, receiving data about a data object accessible to a mobile communication device, and storing the data in a data store accessible to the server computer;

b) at the server computer, analyzing the data about the data object to produce a categorization assessment, and storing the categorization assessment in the data store accessible to the server computer;

c) at the server computer, based upon a trigger selected from the group consisting of receipt of more data about the data object, receipt of more data about mobile communication devices, and an update to the server computer analyzing capability, re-analyzing the data about the data object;

d) at the server, based upon the re-analyzing, producing an updated categorization assessment; and

,

e) at the server, sending a notification based upon the updated categorization assessment.

20. The non-transitory computer readable storage medium of claim 19 wherein the data received in step (a) is binary data from the data object.

21. The non-transitory computer readable storage medium of claim 19 wherein the data received in step (a) is metadata about the data object.

22. The non-transitory computer readable storage medium of claim 19 wherein the data received in step (a) is behavioral data about the data object.

23. The non-transitory computer readable storage medium of claim 19 wherein the analyzing step (b) uses API analysis.

24. The non-transitory computer readable storage medium of claim 19 wherein the analyzing step (b) uses static analysis.

25. The non-transitory computer readable storage medium of claim 19 wherein the analyzing step (b) uses dynamic analysis.

26. The non-transitory computer readable storage medium of claim 19 wherein the analyzing step (b) uses behavioral analysis.

27. The non-transitory computer readable storage medium of claim 19 wherein the analyzing step (b) uses code path analysis.

28. The non-transitory computer readable storage medium of claim 19 wherein the re-analyzing step (c) uses API analysis.

29. The non-transitory computer readable storage medium of claim 19 wherein the re-analyzing step (c) uses static analysis.

30. The non-transitory computer readable storage medium of claim 19 wherein the re-analyzing step (c) uses dynamic analysis.

31. The non-transitory computer readable storage medium of claim 19 wherein the re-analyzing step (c) uses behavioral analysis.

32. The non-transitory computer readable storage medium of claim 19 wherein the re-analyzing step (c) uses code path analysis.

33. The non-transitory computer readable storage medium of claim 19 wherein the sending a notification step (e) includes an action of notifying a software application on the mobile communication device.

34. The non-transitory computer readable storage medium of claim 19 wherein the sending a notification step (e) includes an action of notifying a use of the mobile communication device by sending a message to the user via a messaging system.

35. The non-transitory computer readable storage medium of claim 19 wherein the notification in step (e) is a warning.

36. The non-transitory computer readable storage medium of claim 19 wherein the notification in step (e) is an instruction to uninstall the data object.