EXPRESSING INTENT TO CONTROL BEHAVIOR OF APPLICATION COMPONENTS

• US 20130326477A1
• Filed: 03/05/2013
• Published: 12/05/2013
• Est. Priority Date: 06/05/2012
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Mahaffey, Kevin, Richardson, David, WYATT, Timothy Michael, HALLIDAY, Derek Joseph
• Granted Patent: US 9,215,074 B2
• Time in Patent Office: Days
• US Class Current: 717/120
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/70 Software maintenance or management
• CPC Class Codes: G06Q 30/0241 Advertisements
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Detection, identification, and control of application behavior dealing with malware, security risks, data privacy, or resource usage can be difficult in an era of complex, composite software applications composed of multiple components. Software applications are analyzed to determine their components and to identify the behaviors associated with each of the components. Components can also be analyzed with respect to similarity of previously known components. Behaviors can include use of personal identifying information or device information, or any actions that can be taken by applications on the device, including user interface displays, notifications, network communications, and file reading or writing actions. Policies to control or restrict the behavior of applications and their components may be defined and applied. In one embodiment this can include the identification of advertising networks and defining policies to permit various opt-out actions for these advertising networks.

Claims

1. A non-transitory computer-readable storage medium storing computer-readable instructions, which when executed, cause a computing apparatus to:

for an application installed on a computing device of a user, determine components of the application;

identify, via at least one processor, at least one behavior associated with each of the components, including a first behavior associated with a first component;

present results from the identifying to the user, the results to include a list of behaviors including the first behavior; and

receive a selection from the user of at least one behavioral preference.

2. The storage medium of claim 1, wherein the at least one behavioral preference is selected from the group consisting of:

opting out of the first behavior;

opting out of one or more of the components including the first component;

a set of user preferences for specifically-identified behaviors; and

a policy.

3. The storage medium of claim 1, wherein the at least one behavioral preference is a policy, and the instructions further cause enforcing the policy on new applications installed on the computing device.

4. The storage medium of claim 1, wherein the selection from the user of at least one behavioral preference is to opt out of the first behavior, and the instructions further cause, after the opting out, running the first component to determine whether the first behavior is active.

5. The storage medium of claim 1, wherein the selection from the user of at least one behavioral preference is to opt out of the first behavior, and the instructions further cause, after the opting out, determining a status of the opting out using an application programming interface of the first component.

6. The storage medium of claim 1, wherein the instructions further cause the computing apparatus to, in response to the selection from the user, reconfigure execution of the first component so that the first behavior no longer occurs on the computing device.

7. A non-transitory computer-readable storage medium storing computer-readable instructions, which when executed, cause a computing apparatus to:

for an application installed on a computing device of a user, determine components of the application;

identify, via at least one processor, at least one behavior associated with each of the components, including a first behavior associated with a first component; and

determine at least one behavioral preference of the user.

8. The storage medium of claim 7, wherein the instructions further cause storing the at least one behavioral preference on the computing device so that the application can locally determine the at least one behavioral preference.

9. The storage medium of claim 7, wherein the instructions further cause the first component to execute in conformance with results from a query of a different computing device, wherein the query includes a user identifier of the user.

10. The storage medium of claim 7, wherein the instructions further cause:

in response to downloading or installing the application, scanning the application to confirm compliance with the at least one behavioral preference of the user; and

if the application violates the at least one behavioral preference, alerting the user of the violation or blocking installation of the application.

11. A method, comprising:

storing, in a memory, a first application comprising computer-readable instructions, which when executed, cause a mobile device of a user to;

determine components of a second application installed on the mobile device;

identify at least one behavior associated with each of the components, including a first behavior associated with a first component; and

determine at least one behavioral preference of the user; and

sending, via at least one processor, over a communication network, the first application for storage in a data processing system for subsequent installation from the data processing system onto the mobile device.

12. The method of claim 11, further comprising communicating, via the at least one processor, with the first application after installation of the first application on the mobile device.

13. The method of claim 11, wherein the data processing system comprises an application marketplace.

14. The method of claim 11, wherein a network operator controls the data processing system, and the mobile device is configured to operate with a cellular network operated by the network operator.

15. The method of claim 11, wherein the first component is a linked library packaged with the second application prior to installation of the second application on the mobile device.

16. A system, comprising:

at least one processor; and

memory storing a first application, which when executed on a mobile device of a user, causes the mobile device to;

determine components of a second application installed on the mobile device;

identify at least one behavior associated with each of the components, including a first behavior associated with a first component; and

determine at least one behavioral preference of the user; and

the memory further storing instructions configured to instruct the at least one processor to send the first application to a data processing system so that the first application can be later installed, over a communication network, on the mobile device from the data processing system.

17. The system of claim 16, wherein the instructions are further configured to instruct the at least one processor to communicate with the first application after installation of the first application on the mobile device.

18. The system claim 16, wherein the first application further causes the mobile device to display opt-out options to the user, wherein the opt-out options are solely for applications already installed on the mobile device.

19. The system of claim 16, wherein the first application further causes the mobile device to display opt-out options to the user, the opt-out options comprising all possible opt-out flows for the user on the mobile device as determined from a database.

20. The system of claim 16, wherein the first component is a portion of the executable code of the second application, and the executable code enables the second application to interact with an advertising network or an analytics network.

21. A method, comprising:

communicating, via at least one processor, with an application executing on a mobile device of a user, the application identifying at least one behavior on the mobile device, the at least one behavior associated with each of a plurality of components of a plurality of other applications installed on the mobile device, and the at least one behavior including a first behavior associated with a first component;

receiving at least one behavioral preference of the user from the mobile device, the at least one behavioral preference determined by the application based on input from the user; and

storing, in a memory, the at least one behavioral preference.

22. The method of claim 21, further comprising storing the at least one behavior.

23. The method of claim 21, further comprising receiving a query from an advertisement network, associated with the first component, the query requesting the at least one behavioral preference of the user.

24. The method of claim 21, further comprising:

receiving, from the mobile device, an identification of the first component; and

running, via the at least one processor, the first component in an emulated environment to determine whether the first behavior is active.

25. The method of claim 21, further comprising receiving a query regarding the at least one behavioral preference in order to determine conformance of a new application with the at least one behavioral preference.

26. The method of claim 21, further comprising providing information in response to a request, received over a communication network, in order to evaluate the at least one behavioral preference and determine how the first component is to behave on the mobile device.

27. The method of claim 21, wherein the application is further configured to, in response to the input from the user, disable execution of the first component on the mobile device.