Malicious application detection
Systems and methods for methods network activity. The methods include receiving at an interface connection data associated with a request from a first device to download an application from a source, downloading the application to a second device based on the request, and executing, using one or more processors executing instructions stored on memory, the downloaded application to obtain behavioral data of the application. The methods further include assigning, using the one or more processors, a risk score to the application based on the behavioral data of the application to determine whether the application is malicious before the application is downloaded by the first device, and implementing, using the one or more processors, a download decision for the first device based on the assigned risk score, wherein the download decision indicates at least whether the first device is able to download the application associated with the request.
1 . A method for monitoring network activity, the method comprising:
receiving, at an interface, connection data from an agent installed on a first device, wherein the connection data includes HyperText Transfer Protocol traffic data associated with a request from the first device to download an application from a source, and
the agent is installed with a root certificate and root privileges that allows the agent to have visibility into and intercept the connection data, and further allows the agent to decrypt the connection data to:
extract a file name from the connection data, wherein the file name includes an application package file, and
confirm the file is an application package file associated with the application requested by the first device by checking a string in a response payload from the source,
wherein the package file executes instructions regarding how the application is to be installed;
communicating a request from a second device to the source based on the received connection data to download the application to the second device;
executing, using one or more processors executing instructions stored on memory, the downloaded application to obtain behavioral data of the application;
assigning, using the one or more processors, a risk score to the application based on the behavioral data of the application to determine whether the application is malicious before the application is downloaded by the first device; and
implementing, using the one or more processors, a download decision for the first device based on the assigned risk score, wherein the download decision indicates at least whether the first device is able to download the application associated with the request.
2 . The method of claim 1 wherein the source is a third-party website.
3 . The method of claim 1 further comprising:
executing a hash algorithm to generate a hash of the package file associated with the application;
comparing the generated hash to at least one stored hash; and
determining whether the generated hash matches the at least one stored hash, wherein the downloaded application is executed at a secure environment associated with the second device upon determining the generated hash does not match the at least one stored hash.
4 . The method of claim 1 wherein the connection data includes an internet protocol (IP) address associated with the source, and domain name associated with the application.
5 . The method of claim 1 wherein receiving the connection data includes:
installing the agent on the first device,
enabling the agent to intercept traffic from the source, and
communicating the connection data to the second device.
6 . The method of claim 1 wherein implementing the download decision includes preventing the first device from downloading the application.
7 . The method of claim 1 wherein implementing the download decision includes:
presenting the risk score to the first device,
requesting confirmation from a user of the first device to download the application,
receiving an input from a user of the first device providing confirmation to download the application, and
enabling the first device to download the application upon receiving confirmation to download the application.
8 . The method of claim 1 wherein the implemented download decision is based on the risk score exceeding a threshold.
9 . The method of claim 1 wherein executing the downloaded application to obtain behavioral data of the application includes:
replicating the application, and
executing the replicated application in a secure environment.
10 . A system for monitoring network activity, the system comprising:
an interface for at least receiving connection data from an agent installed on a first device, wherein the connection data includes HyperText Transfer Protocol traffic data associated with a request from the first device to download an application from a source, and the agent is installed with a root certificate and root privileges that allows the agent to have visibility into and intercept the connection data, and further allows the agent to decrypt the connection data to:
extract a file name from the connection data, wherein the file name includes an application package file, and
confirm the file is an application package file associated with the application requested by the first device by checking a string in a response payload from the source, wherein the package file executes instructions regarding how the application is to be installed;
a second device configured to communicate a request to the source based on the received connection data to download the application from the source; and
one or more processors executing instructions stored on memory to:
execute the downloaded application to obtain behavioral data of the application,
assign a risk score to the application based on the behavioral data of the application to determine whether the application is malicious before the application is downloaded to the first device, and
implement a download decision for the first device based on the assigned risk score, wherein the download decision indicates at least whether the first device is able to download the application associated with the request.
11 . The system of claim 10 wherein the source is a third-party website.
12 . The system of claim 10 wherein the one or more processors are further configured to:
execute a hash algorithm to generate a hash of the package file associated with the application,
compare the generated hash to at least one stored hash, and
determine whether the generated hash matches the at least one stored hash, wherein the downloaded application is executed at a secure environment associated with the second device upon determining the generated hash does not match the at least one stored hash.
13 . The system of claim 10 wherein the connection data includes an internet protocol (IP) address associated with the source, and domain name associated with the application.
14 . The system of claim 10 wherein the system receives the connection data by:
installing the agent on the first device,
enabling the agent to intercept traffic from the source, and
communicating the connection data to the second device.
15 . The system of claim 10 wherein the one or more processors implement the download decision by preventing the first device from downloading the application.
16 . The system of claim 10 wherein the one or more processors implement the download decision by:
presenting the risk score to the first device, and
enabling the first device to download the application.
17 . The system of claim 10 wherein the implemented download decision is based on the risk score exceeding a threshold.
18 . The system of claim 10 wherein the one or more processors execute the downloaded application by:
replicating the application, and
executing the replicated application in a secure environment.
19 . A computer program product for monitoring network activity, the computer program product comprising computer executable code embodied in one or more non- transitory computer readable media that, when executing on one or more processors, performs the steps of:
receiving, at an interface, connection data from an agent installed on a first device, wherein the connection data includes HyperText Transfer Protocol traffic data associated with a request from the first device to download an application from a source, and
the agent is installed with a root certificate and root privileges that allows the agent to have visibility into and intercept the connection data and further allows the agent to decrypt the connection data to;
extract a file name from the connection data, wherein the file name includes an application package file,
confirm the file is an application package file associated with the application requested by the first device by checking a string in a response payload from the source, wherein the package file executes instructions regarding how the application is to be installed;
communicating a request from a second device to the source based on the received connection data to download the application to the second device based on the request;
executing the downloaded application to obtain behavioral data of the application;
assigning a risk score to the application based on the behavioral data of the application to determine whether the application is malicious before the application is downloaded to the first device; and
implementing a download decision for the first device based on the assigned risk score, wherein the download decision indicates at least whether the first device is able to download the application associated with the request.
20 . The computer program product of claim 19 wherein the computer program product further comprises computer executable code that, when executing on one or more processors, performs the steps of:
presenting the risk score to the first device,
requesting confirmation from a user of the first device to download the application,
receiving an input from a user of the first device providing confirmation to download the application, and
enabling the first device to download the application upon receiving confirmation to download the application.