MOBILE URL CATEGORIZATION

• US 20190014169A1
• Filed: 08/21/2018
• Published: 01/10/2019
• Est. Priority Date: 09/30/2014
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Chung, Seokkyung, Rostamabadi, Farshad, Hewlett, II, William Redington, Xu, Zhi, Rostami-Hesarsorkh, Shadi, Xu, Lin, Klarich, Lee
• Granted Patent: US 10,554,736 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/35 Clustering; Classification
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/21 for social networking applications
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

Techniques for categorizing mobile uniform resource locators (URLs) that are used by mobile applications are disclosed. A URL is extracted from a mobile application. A category for the URL is determined based on a categorization of the mobile application. The URL and its determined category are then generated as output.

Claims

1. A system, comprising:

a processor configured to;

extract a Uniform Resource Locator (URL) from a mobile application;

determine a category for the URL based on a categorization of the mobile application; and

generate as output the URL and its determined category; and

a memory coupled to the set of one or more processors and configured to provide the set of one or more processors with instructions.

2. The system of claim 1 wherein extracting the URL includes performing static analysis on the mobile application to identify embedded URLs.

3. The system of claim 1 wherein extracting the URL includes performing dynamic analysis on the mobile application to identify dynamically generated URLs.

4. The system of claim 1 wherein the processor is further configured to categorize the is mobile application.

5. The system of claim 4 wherein the mobile application is categorized at least in part by matching a keyword list against words extracted from the mobile application during static analysis.

6. The system of claim 4 wherein the mobile application is categorized at least in part based zo on performing an analysis on a textual description of the mobile application obtained from a mobile application store.

7. The system of claim 4 wherein the mobile application is categorized at least in part based on performing an analysis of information associated with a developer of the mobile application, wherein the information is obtained from a mobile application store.

8. The system of claim 4 wherein the mobile application is categorized at least in part based on performing a categorization analysis of applications designated as similar to the mobile application in a mobile application store.

9. The system of claim 1 wherein assigning the category includes assigning a severity level.

10. The system of claim 1 wherein the set of one or more processors is further configured to include the first URL in a training set.

11. A method, comprising:

extracting a Uniform Resource Locator (URL) from a mobile application;

determining a category for the URL based on a categorization of the mobile application; and

generating as output the URL and its determined category.

12. The method of claim 11 wherein extracting the URL includes performing static analysis on the mobile application to identify embedded URLs.

13. The method of claim 11 wherein extracting URL includes performing dynamic analysis on the mobile application to identify dynamically generated URLs.

14. The method of claim 11 further comprising categorizing the mobile application.

15. The method of claim 14 wherein the mobile application is categorized at least in part by matching a keyword list against words extracted from the mobile application during static analysis.

16. The method of claim 14 wherein the mobile application is categorized at least in part based on performing an analysis on a textual description of the mobile application obtained from a mobile application store.

17. The method of claim 14 wherein the mobile application is categorized at least in part based on performing an analysis of information associated with a developer of the mobile application, wherein the information is obtained from a mobile application store.

18. The method of claim 14 wherein the mobile application is categorized at least in part based on performing a categorization analysis of applications designated as similar to the mobile application in a mobile application store.

19. The method of claim 11 wherein assigning the category includes assigning a severity level.

20. The method of claim 11 further comprising including the first URL in a training set.