Systems and methods for providing information identifying the trustworthiness of applications on application distribution platforms

• US 9,313,218 B1
• Filed: 07/23/2014
• Issued: 04/12/2016
• Est. Priority Date: 07/23/2014
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Savant, Anubhav
• Primary Examiner(s): Zecher, Dede
• Assistant Examiner(s): Doan, Trang
• Application Number:
  US14/338,539
• Time in Patent Office: 629 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

The disclosed computer-implemented method for providing information identifying the trustworthiness of applications on application distribution platforms may include (1) monitoring event notifications generated by an accessibility service that provides user interface enhancements for disabled individuals on an operating system installed on a computing device, (2) determining, based on an analysis of an event notification generated by the accessibility service, that a user is viewing at least one application for download on an application distribution platform, (3) in response to determining that the user is viewing the application on the application distribution platform, identifying the application based at least in part on an analysis of an active window of the computing device, (4) once the application is identified, retrieving information from a third party that identifies the trustworthiness of the application, and (5) before the user downloads the application, displaying the information identifying the trustworthiness of the application to the user.

Claims

1. A computer-implemented method for providing information identifying the trustworthiness of applications on application distribution platforms, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

monitoring event notifications generated by an accessibility service that provides user interface enhancements for disabled individuals on an operating system installed on the computing device;

determining, based on an analysis of an event notification generated by the accessibility service, that a user is viewing at least one application for download on an application distribution platform;

in response to determining that the event notification generated by the accessibility service indicates that the user is viewing the application on the application distribution platform, identifying the application that the user is viewing by applying a set of rules based on characteristics of the computing device to content of an active window that is currently displayed on a screen of the computing device in order to search for an indication of a name of the application;

once the application is identified, retrieving information from a third party that identifies the trustworthiness of the application;

before the user downloads the application, displaying the information identifying the trustworthiness of the application to the user.

2. The computer-implemented method of claim 1, further comprising, prior to monitoring the event notifications generated by the accessibility service, prompting the user to enable permissions on the computing device required by the accessibility service.

3. The computer-implemented method of claim 1, wherein:

determining that the user is viewing the application on the application distribution platform comprises identifying the application distribution platform;

analyzing the active window comprises applying a set of rules to the active window based at least in part on characteristics of the application distribution platform.

4. The computer-implemented method of claim 1, wherein identifying the application comprises identifying at least one of:

a name of the application;

a publisher of the application.

5. The computer-implemented method of claim 1, wherein analyzing the active window comprises analyzing at least one of:

a layout of the active window;

content of the active window.

6. The computer-implemented method of claim 1, wherein analyzing the active window comprises applying a set of rules to the active window based at least in part on characteristics of the computing device.

7. The computer-implemented method of claim 6, wherein the characteristics of the computing device comprise at least one of:

the size of the active window on the computing device;

a type of the computing device;

the operating system installed on the computing device.

8. The computer-implemented method of claim 1, wherein the third party that provides the information identifying the trustworthiness of the application comprises an external server that stores information identifying the trustworthiness of a plurality of applications.

9. The computer-implemented method of claim 1, wherein the information identifying the trustworthiness of the application comprises at least one of:

results of a malware scan performed on the application;

user reviews indicating the performance of the application;

user reviews indicating the security of the application.

10. A system for providing information identifying the trustworthiness of applications on application distribution platforms, the system comprising:

a monitoring module, stored in memory, that monitors event notifications generated by an accessibility service that provides user interface enhancements for disabled individuals on an operating system installed on a computing device;

a determination module, stored in memory, that determines, based on an analysis of an event notification generated by the accessibility service, that a user is viewing at least one application for download on an application distribution platform;

an identification module, stored in memory, that in response to determining that the event notification generated by the accessibility service indicates that the user is viewing the application on the application distribution platform, identifies the application that the user is viewing by applying a set of rules based on characteristics of the computing device to content of an active window that is currently displayed on a screen of the computing device in order to search for an indication of a name of the application;

a retrieving module, stored in memory, that once the application is identified, retrieves information from a third party that identifies the trustworthiness of the application;

a display module, stored in memory, that before the user downloads the application, displays the information identifying the trustworthiness of the application to the user;

at least one hardware processor that executes the monitoring module, the determination module, the identification module, the retrieving module, and the display module.

11. The system of claim 10, further comprising a prompting module that, prior to monitoring the event notifications generated by the accessibility service, prompts the user to enable permissions on the computing device required by the accessibility service.

12. The system of claim 10, wherein:

the determination module determines that the user is viewing the application on the application distribution platform by identifying the application distribution platform;

the determination module analyzes the active window by applying a set of rules to the active window based at least in part on characteristics of the application distribution platform.

13. The system of claim 10, wherein the identification module identifies the application by identifying at least one of:

a name of the application;

a publisher of the application.

14. The system of claim 10, wherein the determination module analyzes the active window by analyzing at least one of:

a layout of the active window;

content of the active window.

15. The system of claim 10, wherein the determination module analyzes the active window by applying a set of rules to the active window based at least in part on characteristics of the computing device.

16. The system of claim 15, wherein the characteristics of the computing device comprise at least one of:

the size of the active window on the computing device;

a type of the computing device;

the operating system installed on the computing device.

17. The system of claim 10, wherein the third party that provides the information identifying the trustworthiness of the application comprises an external server that stores information identifying the trustworthiness of a plurality of applications.

18. The system of claim 10, wherein the information identifying the trustworthiness of the application comprises at least one of:

results of a malware scan performed on the application;

user reviews indicating the performance of the application;

user reviews indicating the security of the application.

19. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

monitor event notifications generated by an accessibility service that provides user interface enhancements for disabled individuals on an operating system installed on the computing device;

determine, based on an analysis of an event notification generated by the accessibility service, that a user is viewing at least one application for download on an application distribution platform;

in response to determining that the event notification generated by the accessibility service indicates that the user is viewing the application on the application distribution platform, identify the application that the user is viewing by applying a set of rules based on characteristics of the computing device to content of an active window that is currently displayed on a screen of the computing device in order to search for an indication of a name of the application;

once the application is identified, retrieve information from a third party that identifies the trustworthiness of the application;

before the user downloads the application, display the information identifying the trustworthiness of the application to the user.

20. The non-transitory computer-readable medium of claim 19, wherein the computer-executable instructions cause the computing device to analyze the active window by applying a set of rules to the active window based at least in part on characteristics of the computing device.