COMPONENT ANALYSIS OF SOFTWARE APPLICATIONS ON COMPUTING DEVICES

• US 20130326476A1
• Filed: 12/03/2012
• Published: 12/05/2013
• Est. Priority Date: 06/05/2012
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Wyatt, Timothy Micheal, Mahaffey, Kevin, Halliday, Derek Joseph
• Granted Patent: US 9,407,443 B2
• Time in Patent Office: Days
• US Class Current: 717/120
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/70 Software maintenance or management
• CPC Class Codes: G06Q 30/0241 Advertisements
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Detection, identification, and control of application behavior dealing with malware, security risks, data privacy, or resource usage can be difficult in an era of complex, composite software applications composed of multiple components. Software applications are analyzed to determine their components and to identify the behaviors associated with each of the components. Components can also be analyzed with respect to similarity of previously known components. Behaviors can include use of personal identifying information or device information, or any actions that can be taken by applications on the device, including user interface displays, notifications, network communications, and file reading or writing actions. Policies to control or restrict the behavior of applications and their components may be defined and applied. In one embodiment this can include the identification of advertising networks and defining policies to permit various opt-out actions for these advertising networks.

Claims

1. A non-transitory computer-readable storage medium storing computer-readable instructions, which when executed, cause a computing system to:

for an application installed on a computing device of a user, determine components of the application; and

identify, via at least one processor, at least one behavior associated with each of the components, including a first behavior associated with a first component.

2. The storage medium of claim 1, wherein the instructions further cause the computing system to present, on a user display of the computing device, an identification of the components.

3. The storage medium of claim 1, wherein the instructions further cause the computing system to determine at least one behavioral preference of the user.

4. The storage medium of claim 3, wherein the instructions further cause the computing system to store a user policy based at least in part on the at least one behavioral preference, and to enforce the user policy on new applications installed on the computing device.

5. The storage medium of claim 1, wherein the instructions further cause the first component to execute in conformance with results from a query of a server.

6. The storage medium of claim 1, wherein the instructions further cause the computing system to, in response to installing the application, scan the application to confirm compliance with a user policy of the user, the user policy stored on an identity server.

7. The storage medium of claim 1, wherein the instructions further cause the computing system to enforce, based on identified behaviors associated with the components, a user policy for each of the components.

8. The storage medium of claim 7, wherein the instructions further cause the computing system to compare permissible behaviors in the user policy for the components with the identified behaviors.

9. The storage medium of claim 8, wherein the comparing of the permissible behaviors comprises determining behaviors, observed for the components on one or more other computing devices, from a data repository.

10. The storage medium of claim 9, wherein the instructions further cause the computing device to, in response to the determining the behaviors from the data repository, configure or disable execution of one or more of the components on the computing device.

11. A system, comprising:

a data repository storing component data for known components, the component data including data for a first known component;

at least one processor; and

memory storing instructions, which when executed on a computing apparatus, cause the computing apparatus to;

for a new component in a first application for a computing device of a user, perform a comparison of the new component to the component data; and

based on the comparison, make a determination that the new component corresponds to the first known component.

12. The system of claim 11, wherein the instructions further cause the computing apparatus to, in response to the determination, perform at least one of:

comparing a first known behavior of the first known component to a user policy of the user; and

comparing an observed behavior of the new component to the user policy.

13. The system of claim 11, wherein the component data includes component identities, each component identity corresponding to respective identifying information for a known component.

14. The system of claim 11, wherein the determination is made prior to installing the new component on the computing device.

15. The system of claim 11, wherein the instructions further cause the computing apparatus to associate a similarity value with the comparison, and wherein the determination is made in response to the similarity value being greater than a threshold value.

16. The system of claim 11, wherein the comparison is based at least in part on a structure of the new component, the structure selected from the group consisting of a packaging structure, a module structure, and an executable code structure.

17. The system of claim 11, wherein the comparison is based at least in part on an executable code structure of the new component.

18. The system of claim 16, wherein the component data includes known structural characteristics and known behavioral characteristics.

19. The system of claim 18, wherein the performing the comparison comprises comparing the known structural characteristics and the known behavioral characteristics to identified characteristics of the new component.

20. The system of claim 19, wherein the instructions further cause the computing apparatus to generate a notification when the identified characteristics are determined to differ from at least one of the known structural characteristics and the known behavioral characteristics.

21. The system of claim 20, wherein the generating the notification comprises sending an alert to the computing device.

22. A method, comprising:

storing, in memory, component data for known components, the component data including data for a first known component;

for a new component in a first application for a computing device of a user, perform, via at least one processor, a comparison of the new component to the component data; and

based on the comparison, make a determination that the new component corresponds to the first known component.

23. The method of claim 22, wherein the new component is selected from the group consisting of code from the first application, and a library in the first application.

24. The method of claim 22, wherein each of a plurality of different applications includes the new component, the new component corresponds to a set of behaviors when executed on a computing device, and the component data comprises behavioral data including the set of behaviors.

25. The method of claim 24, further comprising associating the set of behaviors with the new component.

26. The method of claim 25, wherein each of a plurality of computing devices has been observed when running a respective one of the different applications, and each of the plurality of computing devices exhibits the set of behaviors.

27. The method of claim 24, wherein the determination is based in part on a context of operation of the new component on the computing device.

28. The method of claim 27, wherein the context is an accessing, during execution of the first application, of location information while the first application has a visible presence to a user, and the set of behaviors includes determining a location of the computing device.

29. The method of claim 28, wherein the component data includes a plurality of contexts each associated with at least one acceptable behavior.

30. The method of claim 22, wherein the component data includes risk scores for known components, and the method further comprising providing a risk score in response to a query regarding an application installed or to be installed on the computing device of the user.

31. A method, comprising:

storing, in memory, a first application comprising computer-readable instructions, which when executed, cause a mobile device of a user to;

for a new component of a second application installed on the mobile device, perform a comparison of the new component to component data for known components, the component data including data for a first known component; and

based on the comparison, make a determination that the new component corresponds to the first known component; and

sending, via at least one processor, over a communication network, the first application for storage in a data processing system for subsequent installation from the data processing system onto the mobile device.

32. A system, comprising:

at least one processor; and

memory storing a first application, which when executed on a mobile device of a user, causes the mobile device to;

for a new component of a second application installed on the mobile device, perform a comparison of the new component to component data for known components, the component data including data for a first known component; and

based on the comparison, make a determination that the new component corresponds to the first known component; and

the memory further storing instructions configured to instruct the at least one processor to send the first application to a data processing system so that the first application can be later installed, over a communication network, on the mobile device from the data processing system.