Using signals from developer clusters

• US 9,996,691 B1
• Filed: 07/16/2015
• Issued: 06/12/2018
• Est. Priority Date: 01/19/2014
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google LLC (Alphabet Inc.)
• Inventors: Terribilini, Ryan James, Go, Alec
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US14/801,526
• Time in Patent Office: 1,062 Days
• Field of Search: 726 22
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems and techniques are provided for the mining signals from developer clusters in an application ecosystem and the creation of rules to proactively ban applications when they are submitted to the application ecosystem. Applications may be received. Each application may be associated with a developer account that submitted the application to an application ecosystem. Signals may be extracted for one of the applications from one of the applications and the developer accounts. A banned prevalence percentage may be determined for the signal. A signal rule may be generated from the signal based on the banned prevalence percentage for the signal. The signal rule may be stored.

Claims

1. A method comprising:

receiving, by a data processing apparatus, at least one application associated with an associated developer account that submitted the at least one application to an application ecosystem;

extracting, by the data processing apparatus, at least one signal for the at least one application from at least one of the at least one application or the associated developer account, wherein each signal from the at least one signal comprises an indicator that provides information relating to a particular aspect of either the respective application or the respective associated developer account;

determining, by the data processing apparatus, a banned prevalence percentage for the at least one signal, the banned prevalence percentage indicating either a number of banned developer accounts that include the at least one signal relative to a total number of developer accounts in the application ecosystem or a number of banned applications that include the at least one signal relative to a total number of applications in the application ecosystem;

comparing, by the data processing apparatus, the banned prevalence percentage to a banned prevalence percentage threshold for the at least one signal;

generating, by the data processing apparatus, at least one signal rule for the at least one signal based on the comparison of the banned prevalence percentage to the banned prevalence percentage threshold for the at least one signal; and

storing the at least one signal rule.

2. The method of claim 1, further comprising:

receiving, by the data processing apparatus, an application submitted to the application ecosystem from a developer account that is not banned;

extracting, by the data processing apparatus, at least one signal for the application submitted to the application ecosystem from at least one of the submitted application or the developer account; and

applying, by the data processing apparatus, the at least one signal rule to the application submitted to the application ecosystem.

3. The method of claim 2, wherein applying the at least one signal rule to the application submitted to the application ecosystem comprises one selected from the group consisting of:

allowing the submitted application into the application ecosystem, flagging the submitted application for review, banning the submitted application from the application ecosystem, and banning the submitted application and the developer account that submitted the application from the application ecosystem.

4. The method of claim 2, wherein applying the at least one signal rule to the at least one signal from the application submitted to the application ecosystem further comprises determining if the at least one signal rule is applicable to the application submitted to the application ecosystem based on the at least one signal extracted from the application submitted to the application ecosystem.

5. The method of claim 1, wherein generating the at least one signal rule further comprises:

determining an amount by which the banned prevalence percentage exceeds the banned prevalence percentage threshold; and

selecting an effect of the at least one signal rule based on the amount by which the banned prevalence percentage exceeds the banned prevalence percentage threshold.

6. The method of claim 1, wherein generating the at least one signal rule further comprises:

determining whether a quantity of occurrences of the at least one signal in the application ecosystem exceeds a sample size threshold; and

selecting an effect of the at least one signal rule based on whether the quantity of occurrences of the at least one signal in the application ecosystem exceeds the sample size threshold.

7. The method of claim 1, wherein the at least one signal rule comprises the at least one signal, a characteristic of the at least one signal, and an action for an application comprising one of:

flagging the submitted application for review, and banning the submitted application from the application ecosystem.

8. The method of claim 7, further comprising:

determining the action based on the banned prevalence percentage for the at least one signal and the banned prevalence percentage threshold for the at least one signal.

9. The method of claim 1, wherein the associated developer account associated with the at least one application is in a developer cluster within the application ecosystem, wherein the developer cluster comprises a plurality of developer accounts that each share a common characteristic.

10. The method of claim 1, wherein the indicator of a first signal of the at least one signal provides information relating to one or more of account information, application information, and financial information,

wherein the account information comprises one item selected from the group consisting of:

spam information, Internet Protocol address information, and umbrella account conversion time information,

wherein the application information comprises one or more of application flagging information, advertising identification information, certificate information, asset information, and combination application information, and

wherein the financial information comprises buyer information.

11. The method of claim 10, wherein the spam information comprises a score based on a quantity of umbrella accounts and developer accounts associated with a user of the associated developer account that submitted the at least one application.

12. The method of claim 10, wherein the Internet Protocol address information is based on an Internet Protocol address associated with the associated developer account that submitted the at least one application.

13. The method of claim 10, wherein the umbrella account conversion time information is based on an amount of elapsed time between creation of an umbrella account and a conversion of the umbrella account into the associated developer account that submitted the at least one application.

14. The method of claim 10, wherein the application flagging information is based on a flag set for the at least one application submitted from the associated developer account to the application ecosystem, wherein the flag indicates a security risk or policy violation in the at least one application.

15. The method of claim 10, wherein the advertising identification information is based on advertising identifiers issued by the application ecosystem for use in the at least one application.

16. The method of claim 10, wherein the asset information is based on assets used to build the at least one application.

17. The method of claim 10, wherein the buyer information is based on at least one data item for a user associated with the associated developer account that submitted the at least one application.

18. The method of claim 17, wherein the at least one data item comprises one or more of a contact name, a company name, a phone number, a physical address, an email address domain, an email address, a payment instrument, an Internet Protocol address, and a unique identifier for a computing device.

19. The method of claim 10, wherein the combination application information is based on the advertising identification information, the certificate information, and the asset information for the at least one application.

20. A computer-implemented system comprising:

a storage component configured to store one or more developer accounts from an application ecosystem and one or more signal rules, wherein the each developer account from the one or more developer accounts are associated with a respective one or more applications;

a signal miner configured to;

receive the one or more developer accounts,

extract a first signal from the respective one or more applications associated with a first developer account from the one or more developer accounts,

determine a banned prevalence percentage for the first signal, the banned prevalence percentage indicating either a number of banned developer accounts that include the first signal relative to a total number of developer accounts in the application ecosystem that include the first signal or a number of banned applications that include the first signal relative to a total number of applications in the application ecosystem that include the first signal,

compare the banned prevalence percentage for the first signal to a banned prevalence percentage threshold for the first signal, and

generate a first signal rule for the first signal based on the comparison of the banned prevalence percentage for the first signal to the banned prevalence percentage threshold for the first signal; and

an application filter configured to;

receive a new application submitted to the application ecosystem, wherein the new applications include the first signal, and

apply the first signal rule to the new application.

21. The computer-implemented system of claim 20, wherein the application filter is configured to apply the first signal rule by allowing the new application into the application ecosystem, flagging the new application for review, banning the new application from the application ecosystem, or banning the new application and a developer account that submitted the new application from the application ecosystem.

22. The computer-implemented system of claim 20, wherein the signal miner is configured to generate the first signal rule by being configured to:

determine an amount by which the banned prevalence percentage for the first signal exceeds a banned prevalence percentage threshold, and

select an effect of the first signal rule based on the amount by which the banned prevalence percentage exceeds the banned prevalence percentage threshold.

23. A system comprising:

one or more computers; and

one or more storage devices storing instructions which, when executed by the one or more computers, cause the one or more computers to perform operations comprising;

receiving at least one application associated with an associated developer account that submitted the at least one application to an application ecosystem;

extracting at least one signal for the at least one application from at least one of the at least one application or the associated developer account, wherein each signal from the at least one signal comprises an indicator that provides information relating to a particular aspect of either the respective application or the respective associated developer account;

determining a banned prevalence percentage for the at least one signal, the banned prevalence percentage indicating either a number of banned developer accounts that include the at least one signal relative to a total number of developer accounts in the application ecosystem or a number of banned applications that include the at least one signal relative to a total number of applications in the application ecosystem;

comparing the banned prevalence percentage to a banned prevalence percentage threshold for the at least one signal;

generating at least one signal rule for the at least one signal based on the comparison of the banned prevalence percentage to the banned prevalence percentage threshold for the at least one signal; and

storing the at least one signal rule.

24. The system of claim 23, wherein the instructions, when executed by the one or more computers, cause the one or more computer to perform operations further comprising:

receiving an application submitted to the application ecosystem from a developer account that is not banned;

extracting at least one signal for the application submitted to the application ecosystem from at least one of the submitted application or the developer account;

applying the at least one signal rule to the application submitted to the application ecosystem.

25. The system of claim 23, wherein the instructions that cause the one or more computers to perform the operation of generating the at least one signal rule further comprise instructions that, when executed, cause the one or more computers to perform operations further comprising:

determining whether a quantity of occurrences of the at least one signal in the application ecosystem exceeds a sample size threshold; and

selecting an effect of the at least one signal rule based on whether the quantity of occurrences of the at least one signal in the application ecosystem exceeds the sample size threshold.

26. The system of claim 23, wherein the instructions that cause the one or more computers to perform the operation of generating the at least one signal rule further comprise instructions that, when executed, cause the one or more computers to perform operations further comprising:

determining an amount by which the banned prevalence percentage exceeds the banned prevalence percentage threshold; and

selecting an effect of the at least one signal rule based on the amount by which the banned prevalence percentage exceeds the banned prevalence percentage threshold.