SYSTEM AND METHOD FOR ADVERSE MOBILE APPLICATION IDENTIFICATION

• US 20110145920A1
• Filed: 02/23/2011
• Published: 06/16/2011
• Est. Priority Date: 10/21/2008
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: BURGESS, James David, MAHAFFEY, Kevin Patrick, GOLOMBEK, David, WYATT, Timothy Micheal, RICHARDSON, David Luke, Hering, John G.
• Granted Patent: US 8,984,628 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A system and method identifies mobile applications that can have an adverse effect on a mobile device or mobile network. In an implementation, a server monitors behavioral data relating to a mobile application and applies a model to determine if the application has an adverse effect or has the potential to cause an adverse effect on a mobile device or a network the mobile device may connect to. A mobile device may monitor behavioral data, apply a model to the data, and transmit a disposition to the server. The server may aggregate behavioral data or disposition information from multiple devices. The server may transmit or make available the disposition information to a subscriber through a web interface, API, email, or other mechanism. After identifying that an application may have an adverse effect, the server may enact corrective actions, such as generating device or network configuration data.

Claims

1. A method comprising:

on a server in communication with a plurality of mobile communication devices, the plurality connected to a mobile communication device network, monitoring behavioral data for a data object accessed by at least one of the plurality of mobile communication devices;

obtaining and storing in a data store accessible by the server, the behavioral data for the data object;

applying a model to at least some of the obtained behavioral data for the data object to determine whether or not the data object would have an adverse effect on at least one mobile communication device network to create disposition information; and

,

notifying a subscriber about disposition information that includes a determination that the data object would have adverse effects on the mobile communication device network.

2. The method of claim 1, wherein the obtained and stored behavioral data is correlated to mobile communication device data for at least one mobile communication device that accessed the data object.

3. The method of claim 2, wherein the disposition information is accessible to the subscriber through a data feed.

4. The method of claim 2, wherein notifying the subscriber comprises transmitting an email message to the subscriber, the email message including the disposition information.

5. The method of claim 2, wherein notifying the subscriber comprises transmitting a text message to the subscriber, the text message including the disposition information.

6. The method of claim 2, wherein notifying the subscriber comprises generating a web interface for the subscriber to access the disposition information.

7. The method of claim 1, further comprising:

if the disposition information includes a determination that the data object would have adverse effects on the mobile communication device network, preventing the at least one mobile communication device from accessing the data object by generating device configuration information at the server and transmitting it to the mobile communication device.

8. The method of claim 1, further comprising:

if the disposition information includes a determination that the data object would have adverse effects on the mobile communication device network, preventing the data object from accessing the mobile communication device network by generating network configuration information at the server and transmitting it to the mobile communication device network.

9. The method of claim 1, further comprising:

if the disposition information includes a determination that the data object would have an adverse effect on the mobile communication device network, generating at, and transmitting from the server, network infrastructure configuration data to block traffic associated with the data object or block transmission of an application binary for the data object.

10. A method comprising:

on a server in communication with a plurality of mobile communication devices, the plurality connected to a mobile communication device network, monitoring behavioral data for a data object accessed by at least one of the plurality of mobile communication devices;

obtaining and storing in a data store accessible by the server, the behavioral data for the data object;

aggregating behavioral data for multiple instances of access of the data object by a plurality of mobile communication devices;

applying a model to at least some of the aggregated behavioral data for the data object to determine whether or not the data object would have an adverse effect on at least one mobile communication device network to create disposition information; and

,

notifying a subscriber about disposition information that includes a determination that the data object would have adverse effects on the mobile communication device network.

11. The method of claim 10, wherein the obtained and stored behavioral data is correlated to mobile communication device data for at least one mobile communication device that accessed the data object.

12. The method of claim 11, wherein the disposition information is accessible to the subscriber through a data feed.

13. The method of claim 11, wherein notifying the subscriber comprises transmitting an email message to the subscriber, the email message including the disposition information.

14. The method of claim 11, wherein notifying the subscriber comprises transmitting a text message to the subscriber, the text message including the disposition information.

15. The method of claim 11, wherein notifying the subscriber comprises generating a web interface for the subscriber to access the disposition information.

16. The method of claim 10, further comprising:

if the disposition information includes a determination that the data object would have adverse effects on the mobile communication device network, preventing the at least one mobile communication device from accessing the data object by generating device configuration information at the server and transmitting it to the mobile communication device.

17. The method of claim 10, further comprising:

if the disposition information includes a determination that the data object would have adverse effects on the mobile communication device network, preventing the data object from accessing the mobile communication device network by generating network configuration information at the server and transmitting it to the mobile communication device network.

18. A method comprising:

on a server in communication with a plurality of mobile communication devices, the plurality connected to a mobile communication device network, monitoring behavioral data for a data object accessed by at least one of the plurality of mobile communication devices;

obtaining and storing in a data store accessible by the server, the behavioral data for the data object;

applying a model to at least some of the obtained behavioral data for the data object to determine whether or not the data object would have an adverse effect on at least one mobile communication device network to create disposition information;

aggregating disposition information in a data store accessible by the server; and

,

notifying a subscriber about aggregated disposition information that includes an overall assessment of whether the data object would have adverse effects on the mobile communication device network.

19. The method of claim 18, wherein the obtained and stored behavioral data is correlated to mobile communication device data for at least one mobile communication device that accessed the data object.

20. The method of claim 19, wherein the aggregated disposition information is accessible to the subscriber through a data feed.

21. The method of claim 19, wherein notifying the subscriber comprises transmitting an email message to the subscriber, the email message including the aggregated disposition information.

22. The method of claim 19, wherein notifying the subscriber comprises transmitting a text message to the subscriber, the text message including the disposition information.

23. The method of claim 19, wherein notifying the subscriber comprises generating a web interface for the subscriber to access the disposition information.

24. The method of claim 18, further comprising:

if the disposition information includes a determination that the data object would have adverse effects on the mobile communication device network, preventing the at least one mobile communication device from accessing the data object by generating device configuration information at the server and transmitting it to the mobile communication device.

25. The method of claim 18, further comprising:

if the disposition information includes a determination that the data object would have adverse effects on the mobile communication device network, preventing the data object from accessing the mobile communication device network by generating network configuration information at the server and transmitting it to the mobile communication device network.

26. A method comprising:

on a server in communication with a plurality of mobile communication devices, the plurality connected to a mobile communication device network, monitoring behavioral data for a data object accessed by at least one mobile communication device;

obtaining and storing in a data store accessible by the server the behavioral data for the data object;

determining whether the behavioral data for the accessed data object indicates a violation of an application policy that includes a behavioral limitation for the data object to create disposition information;

storing in a data store accessible by the server, disposition information; and

on the server, notifying at least one subscriber disposition information that includes a determination that the data object would violate the application policy.

27. A method comprising:

on a server in communication with a plurality of mobile communication devices, the plurality connected to a mobile communication device network, monitoring behavioral data for a data object accessed by at least one mobile communication device;

obtaining and storing in a data store accessible by the server the behavioral data for the data object;

determining whether the behavioral data for the accessed data object indicates a violation of an application policy that includes a behavioral limitation for the data object to obtain disposition information;

storing in a data store accessible by the server, disposition information about whether the behavior of the accessed data object exceeds the behavioral limitation; and

if the disposition information for the data object indicates a violation of the application policy, using the server, preventing access to the data object by any one of the plurality of mobile communication devices.

28. The method of claim 27, wherein preventing access by any one of the plurality of mobile communication devices comprises generating device configuration information at the server and transmitting it to the mobile communication device.

29. The method of claim 27, wherein preventing access comprises preventing the data object from accessing one or more mobile communication networks by generating network configuration information at the server, and transmitting it to the mobile communication device network.

30. The method of claim 27, wherein preventing access comprises generating network infrastructure configuration data to block traffic associated with the data object or block transmission of an application binary for the data object, and transmitting it to the mobile communication device network.

31. A method comprising:

on a mobile communication device connected to a mobile communication device network, monitoring on the mobile communication device, behavioral data for a data object accessed by the mobile communication device;

on the mobile communication device, obtaining and storing the behavioral data for a data object accessed by the mobile communication device;

on the mobile communication device, applying a model to at least some of the obtained behavioral data to determine whether or not the data object would have an adverse effect on the mobile communication device network to create disposition information;

receiving at the server, disposition information; and

,

from the server, notifying a subscriber about disposition information that includes a determination of the performance of the data object on a specific type of mobile communication device.

32. A method comprising:

receiving at a server, behavioral data from a plurality of mobile communication devices coupled to a mobile communication device network, the behavioral data being associated with an application program executing on each of the plurality of mobile communication devices;

applying a model to the received behavioral data to determine whether or not the application program would have an adverse effect on either the at least one mobile communication device of the plurality of mobile communication devices, the mobile communication device network, or both; and

upon determining that the application program would have an adverse effect on either the at least one mobile communication device, the mobile communication device network, or both, notifying a subscriber of the determination.

33. The method of claim 32 wherein the subscriber comprises a user other than a user of the at least one mobile communication device.

34. The method of claim 32 comprising determining the application program would have an adverse effect on the at least one mobile communication device if executing the application program on the at least one mobile communication device causes the application program to crash.

35. The method of claim 32 comprising calculating a battery consumption rate of the application program based on at least one of CPU usage data, network traffic, or GPS usage associated with the application program;

and

if the battery consumption rate is greater than a threshold rate, determining that the application program would have an adverse effect on the at least one mobile communication device.

36. The method of claim 32 wherein the applying a model to the received behavioral data comprises identifying a number of connections made by the application program, wherein the determination of whether or not the application program would have an adverse effect on the mobile communication device network is based on the number of connections made by the application program.