COMPUTER IMPLEMENTED METHOD FOR CLASSIFYING MOBILE APPLICATIONS AND COMPUTER PROGRAMS THEREOF

• US 20160021174A1
• Filed: 07/16/2015
• Published: 01/21/2016
• Est. Priority Date: 07/17/2014
• Status: Abandoned Application

• Current Assignee: Telefonica Digital Espana, S.L.U. (Telefonica SA)
• Original Assignee: Telefonica Digital Espana, S.L.U. (Telefonica SA)
• Inventors: GUZMAN SACRISTAN, Antonio, BARROSO BERRUETA, David, ALONSO CEBRIAN, Jose Maria, DE LOS SANTOS VILCHEZ, Sergio
• Application Number:
  US14/800,995
• Publication Number:
  US 20160021174A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/30 Profiles
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A computer implemented method for classifying mobile applications and computer programs thereof.

The method establishes a similarity degree between an application (A) to be classified and one or more classified applications (B) before said application (A) been installed, or broadcasted, in a computing device, the one or more classified applications (B) being already analyzed and stored in a storage unit (400) of a server (150); analyzing, an analyzer unit (500), the application (A) for obtaining features thereof by evaluating: information related to the use made of the digital certificate with which the application (A) has been signed, information of the software package containing the application (A) and/or information related to the publication of the application (A); and as a result of a features comparison of the application (A) with the one or more classified applications (B) classifying the application (A) depending on how much similar it is with the one or more classified applications (B), said classification comprising obtaining a risk assessment of the application (A).

Claims

1. A computer implemented method for classifying mobile applications, the method comprising establishing a similarity degree between a mobile application (A) to be classified and one or more classified mobile applications (B) before said mobile application (A) been installed, or broadcasted, in a mobile computing device of a user (100), wherein the one or more classified mobile applications (B) being already analyzed and stored in a storage unit (400) of a server (150),

characterized in that the method comprises:

a) analyzing, an analyzer unit (500), the mobile application (A) to be classified for obtaining features thereof, said analysis being performed at least by evaluating;

information related to the use made of the digital certificate with which the mobile application (A) has been signed and/or information of the software package containing the mobile application (A) and/or information related to the publication of the mobile application (A);

b) comparing the obtained features of the mobile application (A) with features of the one or more classified mobile applications (B); and

c) as a result of said comparison, classifying the mobile application (A) depending on how much similar the mobile application (A) is with the one or more classified mobile applications (B), said classification comprising obtaining a risk assessment of the mobile application (A).

2. The computer implemented method of claim 1, wherein:

said step a) includes the calculation of a set of estimators from the obtained features of the mobile application (A) and the gathering of the set of calculated estimators in one or more clusters to define an application profile associated to the mobile application (A); and

said step b) includes the comparison of at least one of said clusters with at least one cluster of one of said one or more classified mobile applications (B).

3. The computer implemented method of claim 1, wherein the mobile application (A) is stored in the storage module (400) previous to performing said step a).

4. The computer implemented method of claim 1, wherein the analyzing and storing in the storage unit (400) of the one or more classified mobile applications (B) is performed by an inspector unit (300) of the server (150) after the inspector unit (300) having localized the one or more mobile applications (B) in an application market (610).

5. The computer implemented method of claim 4, wherein the inspector unit (300) continuously updates the features of the one or more classified mobile applications (B) stored in the storage unit (400) by downloading information regarding each mobile application from the application market (610).

6. The computer implemented method of claim 1, wherein said risk assessment of the mobile application (A) being performed by an external unit (620) that specifies the type or types of risk of the first mobile application (A), said type or types of risk including at least malware, adware, or a Potentially Unwanted Application, PUA.

7. The computer implemented method of claim 6, wherein the type or types of risk being specified by including a tag to the mobile application (A).

8. The computer implemented method of claim 1, wherein the information related to the use made of the digital certificate with which the mobile application (A) has been signed at least comprises:

version of the application, serial number, indication from when the application is valid, indication from until the application is valid, public Key used for the signing, information of the public Key, a subject Key identifier, an authority Key identifier, basic constraints, policies of the digital certificate, an algorithm used for the signature, key usage, autoSigned, a certificate of localizations, an identifier for the certificate of localizations, country name, state, locality, an unstructured Address, a common Name, a surname, the device serial number, an unstructured name, a title and/or an email.

9. The computer implemented method of claim 1, wherein the information of the software package containing the mobile application (A) at least comprises:

the Software Development Kit, SDK, used, the modification date of the included files, the creation date of the included files and/or privileges.

10. The computer implemented method of claim 1, wherein the information related to the publication of the mobile application (A) at least comprises:

price, age of the application, date of the developer profile activation, name of the application, description, total Rating, comments, name of the user who give comments, comment rating, current version, email of the developer, official site and/or declared size.

11. A computer program encoded on a non-transitory storage medium, the product comprising non-transitory computer readable instructions for causing one or more processors to perform operations to classify mobile applications, comprising establishing a similarity degree between a mobile application (A) to be classified and one or more classified mobile applications (B) before said mobile application (A) been installed, or broadcasted, in a mobile terminal of a user (100), by:

analyzing the mobile application (A) to be classified for obtaining features thereof, said analysis being performed at least by evaluating;

information related to the use made of the digital certificate with which the mobile application (A) has been signed and/or information of the software package containing the mobile application (A) and/or information related to the publication of the mobile application (A);

comparing the obtained features of the mobile application (A) with features of the one or more classified mobile applications (B); and

classifying the mobile application (A) in view of said comparison, said classification comprising obtaining a risk assessment of the mobile application (A).

12. The computer program of claim 11, wherein the analyzing comprises the calculation of a set of estimators from the obtained features of the mobile application (A) and the gathering of the set of calculated estimators in one or more clusters to define an application profile associated to the mobile application (A);

and the comparing comprises the comparison of at least one of said clusters with at least one cluster of one of said one or more classified mobile applications (B).