Quantifying the risks of applications for mobile devices

1. A system for quantifying risks of applications (“apps”) for mobile devices, comprising:

a processor configured to:

receive an application for a mobile device;

perform an automated analysis of the application based on a risk profile, wherein the risk profile is based on an enterprise policy that includes custom rules for scanning of apps based on security requirements; and

generate a risk score based on the automated analysis of the application based on the risk profile, wherein the generation of the risk score comprises:

check an application cache comprising:

determine whether the application has been previously analyzed; and

in the event that the application has been previously analyzed, return the previously determined risk score of the application;

extract metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof;

query public app market data relating to the application, the public app market data including application description, application ranking in a store, vendor reputation of the application, or any combination thereof;

perform a disassembly/byte code pass comprising:

determine whether the application performs a function based on an inspection of byte code or assembly language of the application, the function including sending text/SMS messages without user's permission, using GPS/location services without user's permission, or any combination thereof; or

any combination thereof; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the processor is further configured to:

determine whether the application is risky based on the risk score.

3. The system recited in claim 1 , wherein the processor is further configured to:

report the risk score.

4. The system recited in claim 1 , wherein the processor is further configured to:

determine whether the application is in violation of the enterprise policy, wherein the enterprise policy includes a malware policy for apps.

5. The system recited in claim 1 , wherein the processor is further configured to:

determine a reputation associated with the application.

6. The system recited in claim 1 , wherein the processor is further configured to:

perform a static analysis on the application during the automated analysis of the application based on the risk profile.

7. The system recited in claim 1 , wherein the processor is further configured to:

perform a dynamic analysis on the application during the automated analysis of the application based on the risk profile.

8. The system recited in claim 1 , wherein the processor is further configured to:

perform a dynamic analysis on the application during the automated analysis of the application based on the risk profile, wherein performing the dynamic analysis includes simulating a plurality of behaviors of the application during execution on a mobile device platform.

9. The system recited in claim 1 , wherein the processor is further configured to:

customize the risk score based on a customized risk scoring profile.

10. The system recited in claim 1 , wherein the processor is further configured to:

customize the risk score based on a customized risk scoring profile, wherein the customized risk scoring profile includes an enterprise-based customization.

11. The system recited in claim 1 , wherein the processor is further configured to:

perform a pre-screening phase that includes checking the application cache, wherein the application cache includes risk scores for previously analyzed applications.

12. The system recited in claim 1 , wherein the processor is further configured to:

perform a pre-screening phase that includes checking the application cache, wherein the application cache includes risk scores for previously analyzed applications that are available from a public app store.

13. The system recited in claim 1 , wherein the processor is further configured to:

upload an application from a private app store to perform the automated analysis of the application based on the risk profile.

14. The system recited in claim 1 , wherein the processor is further configured to:

upload an application from a private app store to perform the automated analysis of the application based on the risk profile, wherein the application is marked as private and is hidden from global app cache queries performed during a pre-screening phase.

15. The system recited in claim 1 , wherein the processor is further configured to:

respond to an app query using the application cache, wherein the application cache includes risk scores for previously analyzed applications.

16. The system recited in claim 1 , wherein the generation of the risk score further comprises:

determine whether the application includes previously known malware, exhibits new malware behaviors, poses a privacy or security risk, or any combination thereof.

17. A method of quantifying risks of applications (“apps”) for mobile devices, comprising:

receiving an application for a mobile device;

performing an automated analysis of the application based on a risk profile using a processor, wherein the risk profile is based on an enterprise policy that includes custom rules for scanning of apps based on security requirements; and

generating a risk score based on the automated analysis of the application based on the risk profile, wherein the generation of the risk score comprises:

checking an application cache comprising:

determining whether the application has been previously analyzed; and

in the event that the application has been previously analyzed, returning the previously determined risk score of the application;

extracting metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof;

querying public app market data relating to the application, the public app market data including application description, application ranking in a store, vendor reputation of the application, or any combination thereof;

performing a disassembly/byte code pass comprising:

determining whether the application performs a function based on an inspection of byte code or assembly language of the application, the function including sending text/SMS messages without user's permission, using GPS/location services without user's permission, or any combination thereof; or

any combination thereof.

18. The method of claim 17 , further comprising:

determining whether the application is risky based on the risk score.

19. The method of claim 17 , further comprising:

reporting the risk score.

20. The method of claim 17 , further comprising:

determining whether the application is in violation of the enterprise policy, wherein the enterprise policy includes a malware policy for apps.

21. The method of claim 17 , further comprising:

determining a reputation associated with the application.

22. A computer program product for quantifying risks of applications (“apps”) for mobile devices, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving an application for a mobile device;

performing an automated analysis of the application based on a risk profile, wherein the risk profile is based on an enterprise policy that includes custom rules for scanning of apps based on security requirements; and

generating a risk score based on the automated analysis of the application based on the risk profile, wherein the generation of the risk score comprises:

checking an application cache comprising:

determining whether the application has been previously analyzed; and

in the event that the application has been previously analyzed, returning the previously determined risk score of the application;

extracting metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof;

querying public app market data relating to the application, the public app market data including application description, application ranking in a store, vendor reputation of the application, or any combination thereof

performing a disassembly/byte code pass comprising:

determining whether the application performs a function based on an inspection of byte code or assembly language of the application, the function including sending text/SMS messages without user's permission, using GPS/location services without user's permission, or any combination thereof; or

any combination thereof.

23. The computer program product recited in claim 22 , further comprising computer instructions for:

determining whether the application is risky based on the risk score.

24. The computer program product recited in claim 22 , further comprising computer instructions for:

reporting the risk score.

25. The computer program product recited in claim 22 , further comprising computer instructions for:

determining whether the application is in violation of the enterprise policy, wherein the enterprise policy includes a malware policy for apps.

26. The computer program product recited in claim 22 , further comprising computer instructions for:

determining a reputation associated with the application.