Application malware filtering for advertising networks

• US 9,027,140 B1
• Filed: 03/11/2014
• Issued: 05/05/2015
• Est. Priority Date: 08/22/2013
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Appthority Incorporated (Gen Digital Inc.)
• Inventors: Watkins, Kevin, Bettini, Anthony John, Guerra, Domingo J., Eyberg, Ian
• Primary Examiner(s): LEE, JASON T
• Application Number:
  US14/205,205
• Time in Patent Office: 420 Days
• Field of Search: 726/1, 726/22, 726/23, 726/24
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06Q 30/0277 Online advertisement
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Application malware filtering for advertising networks is disclosed. For example, techniques for providing a system and process for detecting malicious ad content (e.g., or other undesirable ad content) distributed by advertising (ad) networks are disclosed. In some embodiments, application (“app”) malware filtering for advertising networks includes receiving ad content; processing the ad content; and automatically determining whether the ad content is associated with a malicious app.

Claims

1. A system for application (“

app”

) malware filtering for advertising (“

ad”

) networks, comprising;

a hardware processor of a cloud service for ad network providers for automatically detecting malware apps being distributed through an ad network, the processor configured to;

receive ad content;

process the ad content, comprising;

determine whether the ad content includes a link to an app; and

in the event that the ad content includes the link to the app, scan the app, comprising;

determine an attribute of the app, wherein the attribute includes at least one of a behavior, a feature, or a category;

automatically determine whether the ad content is associated with a malicious app, comprising;

assign a probability score to the ad content based on the attribute of the app;

determine whether the probability score exceeds a threshold value; and

in the event that the probability score exceeds the threshold value, determine the ad content is associated with the malicious app; and

determine that the ad content is associated with malicious or undesirable content based on a policy; and

a memory coupled to the hardware processor and configured to provide the hardware processor with instructions.

2. The system recited in claim 1, wherein the hardware processor is further configured to:

determine that the ad content is associated with an in-app purchase that is associated with the malicious app, the in-app purchase relating to a purchase made within the malicious app.

3. The system recited in claim 1, wherein the hardware processor is further configured to:

determine that the ad content is associated with malicious or undesirable content based on an enterprise policy.

4. The system recited in claim 1, wherein the hardware processor is further configured to:

perform a static analysis of the ad content.

5. The system recited in claim 1, wherein the hardware processor is further configured to:

perform a dynamic analysis of the ad content.

6. The system recited in claim 1, wherein the hardware processor is further configured to:

determine whether the malicious app attempts to thwart malware app detection by using the ad network for app distribution.

7. The system recited in claim 1, wherein the hardware processor is further configured to:

receive the ad content from an ad network provider.

17. The system recited in claim 1, wherein the feature includes app origin/source information, comments associated with the source, executable code, script or source code, an included file, a HyperText Markup Language (HTML) file, a text file, an image file, a video file, an audio file, an embedded file, a compressed archive, a certificate/signed file, an advertising identifier, a software development kit (SDK) used in the app, an authentication server identifier, or a graphical user interface (GUI)/screen shot of the app during execution.

18. The system recited in claim 1, wherein the behavior includes at least one of location tracking, recording, access to content, or toll fraud.

8. A method of application (“

app”

) malware filtering for advertising (“

ad”

) networks, comprising;

receiving ad content;

processing the ad content using a processor of a cloud service for ad network providers for automatically detecting malware apps being distributed through an ad network, comprising;

determining whether the ad content includes a link to an app; and

in the event that the ad content includes the link to the app, scanning the app, comprising;

determining an attribute of the app, wherein the attribute includes at least one of a behavior, a feature, or a category;

automatically determining whether the ad content is associated with a malicious app, comprising;

assigning a probability score to the ad content based on the attribute of the app;

determining whether the probability score exceeds a threshold value; and

in the event that the probability score exceeds the threshold value, determining the ad content is associated with the malicious app; and

determining that the ad content is associated with malicious or undesirable content based on a policy.

9. The method of claim 8, further comprising:

determining that the ad content is associated with an in-app purchase that is associated with the malicious app, the in-app purchase relating to a purchase made within the malicious app.

10. The method of claim 8, further comprising:

determining that the ad content is associated with malicious or undesirable content based on an enterprise policy.

11. A computer program product for application (“

app”

) malware filtering for advertising (“

ad”

) networks, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for;

receiving ad content;

processing the ad content at a cloud service for ad network providers for automatically detecting malware apps being distributed through an ad network, comprising;

determining whether the ad content includes a link to an app; and

in the event that the ad content includes the link to the app, scanning the app, comprising;

determining an attribute of the app, wherein the attribute includes at least one of a behavior, a feature, or a category;

automatically determining whether the ad content is associated with a malicious app, comprising;

assigning a probability score to the ad content based on the attribute of the app;

determining whether the probability score exceeds a threshold value; and

in the event that the probability score exceeds the threshold value, determining the ad content is associated with the malicious app; and

determining that the ad content is associated with malicious or undesirable content based on a policy.

12. The computer program product recited in claim 11, further comprising computer instructions for:

determining that the ad content is associated with an in-app purchase that is associated with the malicious app, the in-app purchase relating to a purchase made within the malicious app.

13. The computer program product recited in claim 11, further comprising computer instructions for:

determining that the ad content is associated with malicious or undesirable content based on an enterprise policy.

14. A system for in-line application (“

app”

) malware filtering for advertising (“

ad”

) networks, comprising;

a hardware processor of a mobile device configured to;

log network traffic to and from the mobile device;

filter the network traffic to extract ad content, comprising;

determine whether the ad content includes a link to an app; and

in the event that the ad content includes the link to the app, scan the app, comprising;

determine an attribute of the app, wherein the attribute includes at least one of a behavior, a feature, or a category;

submit the ad content to a cloud service for automatically detecting malware apps being distributed through one or more ad networks, comprising;

assign a probability score to the ad content based on the attribute of the app;

determine whether the probability score exceeds a threshold value; and

in the event that the probability score exceeds the threshold value, determine the ad content is associated with the;

malicious app; and

receive a response from the cloud service that the ad content is associated with malicious or undesirable content based on a policy; and

a memory coupled to the hardware processor and configured to provide the hardware processor with instructions.

15. The system recited in claim 14, wherein the hardware processor is further configured to:

receive a response from the cloud service that the ad content is associated with an in-app purchase that is associated with a malicious app, the in-app purchase relating to a purchase made within the malicious app.

16. The system recited in claim 14, wherein the hardware processor is further configured to:

receive a response from the cloud service that the ad content is associated with malicious or undesirable content based on an enterprise policy.