Detection of Mutated Apps and Usage Thereof

• US 20160099956A1
• Filed: 10/06/2015
• Published: 04/07/2016
• Est. Priority Date: 10/07/2014
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Skycure Ltd. (Gen Digital Inc.)
• Inventors: Amit, Yair
• Granted Patent: US 9,954,874 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

System, method and product for detection of mutated apps and usage thereof. A method comprises obtaining features of an Application Under Check (AUC); comparing the features with sets of features of applications to determine a host application of the AUC; determining that the AUC is a mutated application of the host application, wherein said determined comprises comparing the AUC with the host application; and in response to said determining, performing a predetermined action. A server may be configured to perform the steps of collecting features relating to trusted applications, wherein the trusted applications are potentially useable as a basis for a mutated application, wherein the features are features that are indicative of a mutated versions of the trusted applications; and retaining the features in a repository, whereby collecting and retaining a list of positive signatures of trusted applications that are useful to approximately identify a host application of a mutated application.

Claims

1. A method performed by a processor, wherein the method comprises:

obtaining features of an Application Under Check (AUC);

comparing the features with sets of features of applications to determine a host application of the AUC;

determining that the AUC is a mutated application of the host application, wherein said determined comprises comparing the AUC with the host application; and

in response to said determining, performing a predetermined action.

2. The method of claim 1, wherein the AUC is obtained from a non-trusted application repository.

3. The method of claim 1, wherein the sets of features of applications are retained in a database, wherein the database is updated based on one or more trusted application repositories.

4. The method of claim 1, wherein the sets of features of applications are retained in a database, wherein the database comprises information relating to applications installed on crowdsourced devices.

5. The method of claim 4, wherein the database comprises information relating the popular applications based on installation information from the crowdsourced devices.

6. The method of claim 1, wherein the mutated application is configured to perform a malicious activity that is not included in the host application.

7. The method of claim 1, wherein the mutated application overrides a Digital Rights Management (DRM) mechanism present in the host application.

8. The method of claim 1, wherein the mutated application replaces a module of the host application by a second module.

9. The method of claim 1, wherein the features of an application comprise one or more of the following features:

a title of the application;

an icon of the application;

a splash screen content of the application;

a look and feel indicator of the application;

a name of a file in a distribution of the application;

content of a file in a distribution of the application, or hash value thereof; and

a resource comprised by a distribution of the application.

10. The method of claim 1 further comprises:

determining that the mutated application is a different version of the host application, wherein said determining comprises;

comparing, between the host application and the AUC at least one of the following;

versioning information;

vendor identification; and

signing certification.

11. The method of claim 1 further comprises:

determining an identical portion of the AUC and a remainder portion of the AUC, wherein the identical portion is identical to a corresponding portion in the host application, wherein the remainder portion of the AUC is not identically included in the host application; and

analyzing the remainder portion to detect different functionality between the AUC and the host application.

12. The method of claim 1, wherein the features of an application comprise a User Interface (UI) layout of the application.

13. A computerized apparatus having a processor, the processor being adapted to perform the steps of claim 1.

14. A computer program product comprising a computer readable storage medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform a method of claim 1.

15. A server having a processor, the server being connected to a network, the processor being adapted to perform the steps of:

collecting features relating to trusted applications, wherein the trusted applications are potentially useable as a basis for a mutated application, wherein the features are features that are indicative of a mutated versions of the trusted applications; and

retaining the features in a repository, whereby collecting and retaining a list of positive signatures of trusted applications that are useful to approximately identify a host application of a mutated application.

16. The server of claim 15, wherein said collecting comprises:

downloading the trusted applications from one or more trusted application repositories; and

extracting the features from the downloaded trusted applications.

17. The server of claim 15, wherein said collecting comprises:

obtaining indications from a plurality of computing devices relating to applications that are installed on the plurality of computing devices;

identifying one or more applications that have a statistical measurement above a predetermined threshold, wherein the identified one or more applications are the trusted applications; and

obtaining the features of the trusted applications.

18. The server of claim 17, wherein said obtaining the features of the trusted applications comprises:

receiving from a computing device the features, wherein the computing device extracts the features from the trusted application installed thereon.

19. The server of claim 17, wherein said obtaining the features of the trusted applications comprises:

receiving from one or more additional computing device the features, wherein the one or more computing devices extract the features from the trusted application installed thereon whereby a malicious attempt to provide false features is detectable; and

selecting from the obtained features of a same trusted application.

20. The server of claim 17, wherein at least a portion of the applications are purchased applications which are purchased by the users and are restricted from being transferred to another device.