Using signals from developer clusters

• US 9,111,093 B1
• Filed: 01/19/2014
• Issued: 08/18/2015
• Est. Priority Date: 01/19/2014
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Go, Alec, Terribilini, Ryan James
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US14/158,860
• Time in Patent Office: 576 Days
• Field of Search: 726/22, 726/23, 726/24, 726/25
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems and techniques are provided for the mining signals from developer clusters in an application ecosystem and the creation of rules to proactively ban applications when they are submitted to the application ecosystem. Applications may be received. Each application may be associated with a developer account that submitted the application to an application ecosystem. Signals may be extracted for one of the applications from one of the applications and the developer accounts. A banned prevalence percentage may be determined for the signal. A signal rule may be generated from the signal based on the banned prevalence percentage for the signal. The signal rule may be stored.

Claims

1. A computer-implemented method performed by a data processing apparatus, the method comprising:

receiving developer accounts from within an application ecosystem, wherein each of the developer accounts has submitted at least one application to the application ecosystem;

extracting signals from the applications submitted from the developer accounts;

determining a banned prevalence percentage for each of the extracted signals, wherein the banned prevalence percentage for one of the extracted signals is based on the number of the extracted signals from the applications comprising a characteristic matching a characteristic of the one of the extracted signals and the number of the extracted signals from banned applications from the applications comprising a characteristic matching the characteristic of the one of the extracted signals;

generating signal rules based on the banned prevalence percentages for the extracted signals, wherein each signal rule comprises one of the extracted signals, the characteristic of the extracted signal, and an action for disposition of an application that triggers the signal rule; and

storing the signal rules.

2. The computer-implemented method of claim 1, further comprising:

receiving a new application submitted to the application ecosystem from a submitting developer account;

extracting signals from the new application;

determining that one or more of the signal rules are triggered by the signals extracted from the new application, wherein one of the signals rules is triggered when one of the signals extracted from the new application matches the extracted signal in the one of the signal rules and the one of the signals extracted from the new application comprises a characteristic matching the characteristic of the extracted signal in the one of the signal rules; and

disposing of the new application in accordance with the actions of the triggered signal rules.

3. The computer-implemented method of claim 1, wherein the action for disposition of the application that triggers the signal rule comprises one item from the group consisting of:

flagging the application for review, and banning the application from the application ecosystem.

4. The computer-implemented method of claim 1, wherein the developer accounts are one of:

all of the developer accounts from within the application ecosystem, and the developer accounts from within a developer cluster of the application ecosystem.

5. The computer-implemented method of claim 1, wherein generating signal rules further comprises determining the action based on a threshold exceeded by the banned prevalence percentage.

6. The computer-implemented method of claim 2, wherein disposing of the new application in accordance with the actions of the triggered signal rules further comprises banning the submitting the developer account when at least a threshold number of the signal rules were triggered by the new application or a specified combination of the signal rules were triggered by the new application.

7. The computer-implemented method of claim 1, wherein:

each of the extracted signal comprises one item selected from the group consisting of;

an account signal, an application signal, or a financial signal, and wherein an account signal comprises one item selected from the group consisting of;

a spam signal, an Internet Protocol address signal, and an umbrella account conversion time signal,

an application signal comprises one item selected from the group consisting of;

an application flagging signal, an advertising identification signal, a certificate signal, an asset signal, and a combination application signal, and

a financial signal comprises a buyer signal.