Automated classification of applications for mobile devices

• US 9,639,694 B2
• Filed: 08/27/2015
• Issued: 05/02/2017
• Est. Priority Date: 06/17/2013
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Appthority Incorporated (Gen Digital Inc.)
• Inventors: Padidar, Sasan, Hanna, Steve, Watkins, Kevin
• Primary Examiner(s): Vy, Hung T
• Application Number:
  US14/838,278
• Publication Number:
  US 20160012220A1
• Time in Patent Office: 614 Days
• Field of Search: 707740, 707737, 709203, 709223, 709224
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Automated classification of applications (“apps”) for mobile devices is provided. In some embodiments, automated classification of apps for mobile devices includes receiving an application (“app”); performing an analysis of the app using a classification engine; and determining an app category for the app based on the analysis performed using the classification engine.

Claims

1. A system for automated classification of applications (“

apps”

) for mobile devices, comprising;

a processor configured to;

receive an application (“

app”

);

perform an analysis of the app using a classification engine, comprising to;

extract data from the app, the data including an image, a string, a keyword and phrase, an uniform resource locator (URL), an email address, a phone number, a database, a Software Development Kit (SDK) in use, or any combination thereof;

determine an app category for the app based on the analysis performed using the classification engine, comprising to;

determine the app category for the app based on the extracted data;

compare a category of an associated market page from which the app was downloaded from an app store and the determined app category for the app;

in the event that the category of the associated market page and the determined app category for the app are different, send a request to the app store to re-categorize the category of the associated market page in the app store to a category corresponding to the determined app category; and

determine whether the app is to be placed on a blacklist with respect to the determined app category based on the determined app category, comprising to;

compare app behavior with a list of unsafe behaviors associated with the app category, wherein;

at least one behavior is in a list of unsafe behaviors associated with a first app category;

the same at least one behavior is in a list of safe behaviors associated with a second app category; and

the first app category is different from the second app category;

in the event that the app behavior matches a behavior on the list of unsafe behaviors associated with the app category, classify the app to be placed on the blacklist with respect to the app category; and

in the event that the app behavior matches a behavior on the list of safe behaviors associated with the app category, classify the app to be placed on a whitelist with respect to the app category; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1, wherein the app category includes business, calendar, electronic mail (e-mail), file sharing, cloud storage, games, maps, messaging, music, office productivity, photo, social video, web browser, or any combination thereof.

3. The system recited in claim 1, wherein the processor is further configured to:

generate a report with at least one app categorization for the app, wherein the report includes at least one suggested app for the app category as an alternative to the app that is not approved for the app category.

4. The system recited in claim 1, wherein the processor is further configured to:

generate a report with at least one app categorization, wherein the app is not approved based on an app policy, and wherein the report includes at least one suggested app for the app category based on the app policy.

5. The system recited in claim 1, wherein the processor is further configured to:

generate a report with at least one app categorization, wherein the app is not approved based on an enterprise app policy, and wherein the report includes at least one suggested app for the app category based on the enterprise app policy.

6. The system recited in claim 1, wherein the processor is further configured to:

generate a report with at least one app categorization, wherein the app is not approved based on an enterprise app policy, wherein the report includes at least one suggested app for the app category based on the enterprise app policy, and wherein the enterprise app policy is configurable by an enterprise for managing apps on mobile devices associated with the enterprise.

7. The system recited in claim 1, wherein the processor is further configured to:

generate a report with at least one app categorization, wherein the app is not approved based on an app policy, wherein the report includes at least one suggested app for the app category based on the app policy, wherein the app is a blacklisted app for the app category based on the app policy, and the at least one suggested app for the app category is a whitelisted app for the app category based on the app policy.

8. The system recited in claim 1, wherein the processor is further configured to:

determine whether a new version of the app has new content or behavior that changes a classification of the app; and

in the event that the new version of the app has new content or behavior that changes a classification of the app, violates an app policy, or a combination thereof, create a new entry within a database to record how the app has changed in the new version and how the new content or behavior has triggered a new or additional app classification, a new or additional app policy violation, or a combination thereof.

9. The system recited in claim 1, wherein the processor is further configured to:

perform an analysis of the app using the classification engine, wherein the performing of the analysis of the app comprises;

extract data from the app, the data including an image, a string, a keyword and phrase, a URL, an email address, a phone number, a database, a Software Development Kit (SDK) in use, or any combination thereof; and

classify the app based on the extracted data and app behavior, the app behavior including perform location tracking, access a contact or address book on a mobile device, access a social app or Application Programming Interface (API), access a device microphone or camera, access a feature or function of the mobile device or operating system platform in a manner that is not consistent or in compliance with permissions granted to the app by a user or the mobile device, or any combination thereof.

10. The system recited in claim 1, wherein:

the at least one behavior corresponds to a location tracking behavior;

the first app category corresponds to a file sharing app category or a cloud storage app category; and

the second app category corresponds to a map app category or a navigation app category.

11. A method of automated classification of applications (“

apps”

) for mobile devices, comprising;

receiving an application (“

app”

);

performing an analysis of the app using a classification engine, comprising to;

extracting data from the app, the data including an image, a string, a keyword and phrase, an uniform resource locator (URL), an email address, a phone number, a database, a Software Development Kit (SDK) in use, or any combination thereof;

determining an app category for the app based on the analysis performed using the classification engine executed on a processor;

determining the app category for the app based on the extracted data;

comparing a category of an associated market page from which the app was downloaded from an app store and the determined app category for the app;

in the event that the category of the associated market page and the determined app category for the app are different, sending a request to the app store to re-categorize the category of the associated market page in the app store to a category corresponding to the determined app category; and

determining whether the app is to be placed on a blacklist with respect to the determined app category based on the determined app category, comprising;

comparing app behavior with a list of unsafe behaviors associated with the app category, wherein;

at least one behavior is in a list of unsafe behaviors associated with a first app category;

the same at least one behavior is in a list of safe behaviors associated with a second app category; and

the first app category is different from the second app category;

in the event that the app behavior matches a behavior on the list of unsafe behaviors associated with the app category, classifying the app to be placed on the blacklist with respect to the app category; and

in the event that the app behavior matches a behavior on the list of safe behaviors associated with the app category, classifying the app to be placed on a whitelist with respect to the app category.

12. The method of claim 11, wherein the app category includes business, calendar, electronic mail (e-mail), file sharing, cloud storage, games, maps, messaging, music, office productivity, photo, social video, web browser, or any combination thereof.

13. The method of claim 11, further comprising:

generating a report with at least one app categorization for the app, wherein the report includes at least one suggested app for the app category as an alternative to the app that is not approved for the app category.

14. The method of claim 11, further comprising:

determining whether a new version of the app has new content or behavior that changes a classification of the app; and

in the event that the new version of the app has new content or behavior that changes a classification of the app, violates an app policy, or a combination thereof, creating a new entry within a database to record how the app has changed in the new version and how the new content or behavior has triggered a new or additional app classification, a new or additional app policy violation, or a combination thereof.

15. A computer program product for automated classification of applications (“

apps”

) for mobile devices, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for;

receiving an application (“

app”

);

performing an analysis of the app using a classification engine, comprising to;

extracting data from the app, the data including an image, a string, a keyword and phrase, an uniform resource locator (URL), an email address, a phone number, a database, a Software Development Kit (SDK) in use, or any combination thereof;

determining an app category for the app based on the analysis performed using the classification engine, comprising;

determining the app category for the app based on the extracted data;

comparing a category of an associated market page from which the app was downloaded from an app store and the determined app category for the app;

in the event that the category of the associated market page and the determined app category for the app are different, sending a request to the app store to re-categorize the category of the associated market page in the app store to a category corresponding to the determined app category; and

determining whether the app is to be placed on a blacklist with respect to the determined app category based on the determined app category, comprising;

comparing app behavior with a list of unsafe behaviors associated with the app category, wherein;

at least one behavior is in a list of unsafe behaviors associated with a first app category;

the same at least one behavior is in a list of safe behaviors associated with a second app category; and

the first app category is different from the second app category;

in the event that the app behavior matches a behavior on the list of unsafe behaviors associated with the app category, classifying the app to be placed on the blacklist with respect to the app category; and

in the event that the app behavior matches a behavior on the list of safe behaviors associated with the app category, classifying the app to be placed on a whitelist with respect to the app category.

16. The computer program product recited in claim 15, wherein the app category includes business, calendar, electronic mail (e-mail), file sharing, cloud storage, games, maps, messaging, music, office productivity, photo, social video, web browser, or any combination thereof.

17. The computer program product recited in claim 16, further comprising computer instructions for:

generating a report with at least one app categorization for the app, wherein the report includes at least one suggested app for the app category as an alternative to the app that is not approved for the app category.

18. The computer program product recited in claim 15, further comprising:

determining whether a new version of the app has new content or behavior that changes a classification of the app; and

in the event that the new version of the app has new content or behavior that changes a classification of the app, violates an app policy, or a combination thereof, creating a new entry within a database to record how the app has changed in the new version and how the new content or behavior has triggered a new or additional app classification, a new or additional app policy violation, or a combination thereof.