SMS botnet detection on mobile devices

1. A method performed by a mobile device, the method comprising:

launching a monitoring application that has a priority receiver attribute for a Short Message Service (SMS), the mobile device being configured to receive a message from the SMS and distribute the message to a group of applications including (i) the monitoring application and (ii) a native application that lacks the priority receiver attribute for SMS;

receiving, within the monitoring application, the message from the SMS;

parsing the message to extract an originating address and message data;

storing, in a data structure controlled by the monitoring application, the extracted originating address and the message data;

detecting whether an application of the group of applications has intercepted the message to prevent at least the native application from receiving the message, wherein the detecting comprises after a predetermined time interval, using the originating address and the message data stored in the data structure to determine whether the message has been stored in a client SMS database residing on the mobile device, the client SMS database being associated with the native application, wherein using the originating address and the message data stored in the data structure comprises querying the client SMS database to determine whether the message was stored in the client SMS database;

if the message has not been stored in the client SMS database, identifying, other than the monitoring application, one or more applications that have the priority receiver attribute for SMS; and

determining whether the one or more identified applications are associated with malicious activity.

2. The method of claim 1 , comprising:

accessing a set of one or more addresses associated with known malicious activity;

determining whether the originating address is present in the set; and

if the message has been stored in the client SMS database and the originating address is associated with known malicious activity, determining whether one or more applications other than the monitoring application are associated with malicious activity.

3. The method of claim 1 , wherein determining whether the one or more identified applications are associated with malicious activity comprises:

sending profile information associated with the message to a server system that is configured to analyze the profile information for malicious activity.

4. The method of claim 3 , wherein the profile information comprises one or more application names that correspond respectively to the one or more applications.

5. The method of claim 1 , wherein identifying the one or more applications comprises excluding one or more system applications.

6. The method of claim 1 , wherein identifying the one or more applications comprises excluding one or more applications that are on a whitelist.

7. A mobile device comprising:

a memory structure that is configured to store information comprising instructions for a monitoring application that has a priority receiver attribute for a Short Message Service (SMS);

a transceiver configured to send and receive data, the transceiver being configured to receive a message via the SMS; and

a processor coupled with the memory structure and the transceiver, the processor being configured to receive a message from the SMS and distribute the message to a group of applications including (i) the monitoring application and (ii) a native application that lacks the priority receiver attribute for SMS, the processor being configured to perform operations comprising:

receiving, within the monitoring application, the message;

parsing the message to extract an originating address and message data;

storing, in a data structure controlled by the monitoring application, the extracted originating address and the message data;

detecting whether an application of the group of applications has intercepted the message to prevent at least the native application from receiving the message, wherein the detecting comprises after a predetermined time interval, using the originating address and the message data stored in the data structure to determine whether the message has been stored in a client SMS database residing on the mobile device, the client SMS database being associated with the native application, wherein using the originating address and the message data stored in the data structure comprises querying the client SMS database to determine whether the message was stored in the client SMS database;

if the message has not been stored in the client SMS database, identifying, other than the monitoring application, one or more applications that have the priority receiver attribute for SMS; and

determining whether the one or more identified applications are associated with malicious activity.

8. The device of claim 7 , wherein the operations comprise:

accessing a set of one or more addresses associated with known malicious activity;

determining whether the originating address is present in the set; and

if the message has been stored in the client SMS database and the originating address is associated with known malicious activity, determining whether one or more applications other than the monitoring application are associated with malicious activity.

9. The device of claim 7 , wherein determining whether the one or more identified applications are associated with malicious activity comprises:

causing the transceiver to send profile information associated with the message to a server system that is configured to analyze the profile information for malicious activity.

10. The device of claim 9 , wherein the profile information comprises one or more application names that correspond respectively to the one or more applications.

11. The device of claim 7 , wherein identifying the one or more applications comprises excluding one or more system applications.

12. The device of claim 7 , wherein identifying the one or more applications comprises excluding one or more applications that are on a whitelist.

13. A system comprising:

an analysis server configured to receive from mobile devices information associated with potential Short Message Service (SMS) attack messages and configured to analyze the information for malicious activity; and

a mobile device configured to receive a SMS message and distribute the SMS message to a group of applications including (i) a monitoring application that has a priority receiver attribute for SMS and (ii) a native application that lacks the priority receiver attribute for SMS, wherein the mobile device is configured to perform operations comprising:

receiving the SMS message within the monitoring application;

parsing the message to extract an originating address and message data;

storing, in a data structure controlled by the monitoring application, the extracted originating address and the message data;

detecting whether an application of the group of applications has intercepted the SMS message to prevent at least the native application from receiving the SMS message, wherein the detecting comprises (i) after a predetermined time interval from a reception of the SMS message, using the originating address and the message data stored in the data structure to determine whether the message has been stored in a client SMS database residing on the mobile device, the client SMS database being associated with the native application and (ii) when the message has not been stored in the client SMS database, identifying, other than the monitoring application, one or more applications of the group of applications that have the priority receiver attribute for SMS, wherein using the originating address and the message data stored in the data structure comprises querying the client SMS database via the native application to determine whether the SMS message was stored in the client SMS database; and

sending the analysis server information comprising a list of the one or more identified applications.

14. The system of claim 13 , wherein the operations comprise:

accessing a set of one or more addresses associated with known malicious activity;

determining whether the originating address is present in the set;

if the message has been stored in the client SMS database and the originating address is associated with known malicious activity, generating a list of one or more applications other than the monitoring application that are configured to receive SMS messages; and

sending the analysis server information comprising the generated list.

15. The system of claim 14 , wherein the analysis server is configured to provide the set of one or more addresses associated with known malicious activity.

16. The system of claim 13 , wherein sending the analysis server informing comprises sending profile information associated with the message, and wherein the analysis server is configured to analyze the profile information for malicious activity.

17. The system of claim 16 , wherein the profile information comprises one or more application names that correspond respectively to the one or more applications.

18. The system of claim 13 , wherein identifying the one or more applications comprises excluding one or more system applications.

19. The system of claim 13 , wherein identifying the one or more applications comprises excluding one or more applications that are on a whitelist.