Security, fraud detection, and fraud mitigation in device-assisted services systems

1. An end-user device, comprising:

one or more modems for enabling the end-user device to communicate over at least a first wireless access network;

memory configured to store:

a first application program configured to execute on the end-user device and further configured to assist the end-user device in accessing one or more data services over at least the first wireless access network,

a first application credential associated with the first application program, and

a first policy to be applied when the first application program initiates or attempts to initiate a communication over the first wireless access network; and

one or more device agents configured to:

detect an attempted installation of update software on the end-user device, the update software purporting to be a modification, update, or replacement of the first application program,

obtain an update-software credential associated with the update software,

obtain the first application credential,

allow the update software to be installed on the end-user device if the update-software credential matches the first application credential, and

interact with the first application program to arrange a setting of the first application program, the setting configured to assist in applying the first policy when the first application program initiates or attempts to initiate a communication over the first wireless access network.

2. The end-user device of claim 1 , wherein at least one of the one or more device agents comprises an installed-agent credential, and further comprising an agent-updating agent configured to:

detect an attempted installation of agent-updating software on the end-user device, the agent-updating software purporting to be a modification, update, or replacement of the at least one of the one or more device agents,

obtain an agent-software-update credential associated with the agent-updating software,

obtain the installed-agent credential, and

allow the agent-updating software to be installed on the end-user device if the agent-software-update credential matches the installed-agent credential.

3. The end-user device recited in claim 1 , wherein the first policy comprises a control policy configured to assist in controlling transmissions or receptions over the first wireless access network associated with the first application program.

4. The end-user device recited in claim 1 , wherein the first policy comprises a charging policy configured to assist in accounting for transmissions or receptions over the first wireless access network associated with the first application program.

5. The end-user device recited in claim 1 , further comprising a user interface, and wherein the first policy comprises a notification policy configured to assist in presenting, through the user interface, a notification message.

6. The end-user device recited in claim 5 , wherein the notification message comprises an indication of an amount or cost of data usage associated with the first application program.

7. The end-user device recited in claim 5 , wherein the notification message comprises an indication of an amount or cost of data usage associated with the first application program during a particular period of time.

8. The end-user device recited in claim 7 , wherein the particular period of time is configured to be selected by a user of the device.

9. The end-user device recited in claim 7 , wherein the notification message comprises an indication of an amount or cost of background data usage associated with the first application program.