Detection of rogue software applications
View Patent ↗Software applications are analyzed to determine if they are legitimate applications and warnings are provided to users to avoid installation and/or purchases of unnecessary and/or potentially harmful software based on comparisons of user-interface characteristics of the software applications to visual characteristics of authentic applications to determine to what extent they match (or do not match) or are attempting to mirror the legitimate application.
1. A method for determining the legitimacy of a software application provided to a user of a computing device, the method comprising:
programmatically detecting, using a processor of a computer device, that the software application is resident on the computing device;
extracting, using the processor, visual user interface characteristics from at least one of an executable file and data files associated with the software application;
collecting and storing the visual user interface characteristics of the software application in a memory;
programmatically comparing the collected visual user interface characteristics to known visual user interface characteristics of at least one known legitimate software application;
when a similarity between the collected visual user interface characteristics and the known visual user interface characteristics surpasses a predefined similarity threshold, analyzing at least one additional characteristic of the software application, wherein the at least one additional characteristic comprises a digital certificate; and
terminating the software application and quarantining the files associated with the software application for subsequent deletion from the computing device when the at least one additional characteristic is indicative of rogue software.
2. The method of claim 1 , wherein the extracting is performed while the software application is not executing on the computing device.
3. The method of claim 1 , wherein the visual user interface characteristics comprise at least one of window title names, screen control names, screen control components, progress bars, lists, buttons, image files, dialog box names, colors, and system tray settings.
4. The method of claim 1 , wherein the legitimate software application comprises an anti-virus application.
5. The method of claim 4 , wherein the software application is a rogue software application masquerading as an authentic anti-virus application.
6. The method of claim 1 , further comprising determining if the digital certificate is valid, and, if not, classifying the software application as rogue software and presenting the user with a message indicating as such.
7. The method of claim 1 , further comprising determining if the source of the software application is a source of known legitimate software applications, and if not, classifying the software application as rogue software and presenting the user with a message indicating as such.
8. The method of claim 1 , further comprising:
determining a binary signature of the software application and determining if the binary signature matches a known binary signature of a known legitimate software application; and
if not, classifying the software application as rogue software and presenting the user with a message indicating as such.
9. The method of claim 1 , further comprising:
presenting the user with a message recommending deletion of the software application.
10. The method of claim 9 , further comprising:
deleting the software application from the computing device in response to user input.
11. A system for determining the legitimacy of a software application provided to a user of a computing device, the system comprising:
at least one memory component for storing computer-executable instructions; and
at least one processor configured to execute computer-executable instructions stored in the at least one memory component, which when executed:
programmatically detect that the software application is resident on the computing device;
extract visual user interface characteristics from at least one of an executable file and data files associated with the software application;
collect and store visual user interface characteristics of the software application;
programmatically compare the collected visual user interface characteristics to known visual user interface characteristics of at least one known legitimate software application;
when a similarity between the collected visual user interface characteristics and the known visual user interface characteristics surpasses a predefined similarity threshold, analyze at least one additional characteristic of the software application, wherein the at least one additional characteristic comprises a permissions list of the software application; and
terminate the software application and quarantine the files associated with the software application for subsequent deletion from the computing device when the at least one additional characteristic is indicative of rogue software.
12. The system of claim 11 , wherein the at least one processor is configured to extract the visual user interface characteristics while the software application is not executing on the computing device.
13. The system of claim 11 , wherein the visual user interface characteristics comprise at least one of window title names, screen control names, screen control components, progress bars, lists, buttons, image files, dialog box names, colors, and system tray settings.
14. The system of claim 11 , wherein the at least one known legitimate software application comprises an anti-virus application.
15. The system of claim 11 , wherein the instructions when executed determine if the permissions list matches a permissions list of a known legitimate software application, and, if not, classify the software application as rogue software and present the user with a message indicating as such.
16. The system of claim 11 , wherein the instructions when executed determine if the source of the software application is a source of known legitimate software applications, and if not, classify the software application as rogue software and present the user with a message indicating as such.
17. The system of claim 11 , wherein the instructions when executed determine the binary signature of the software application and determine if the binary signature matches a known binary signature of a known legitimate software application, and if not, classify the software application as rogue software and present the user with a message indicating as such.
18. The system of claim 11 , wherein the instructions when executed present the user with a message recommending deletion of the software application.
19. The system of claim 18 , wherein the instructions when executed delete the software application from the computing device.
20. A non-transitory program storage medium, comprising instructions encoded thereon that when executed by a computing device:
detect that a software application is resident on the computing device;
extract visual user interface characteristics from at least one of an executable file and data files associated with the software application;
collect and store the visual user interface characteristics of the software application in a memory;
compare the collected visual user interface characteristics to known visual user interface characteristics of at least one known legitimate software application;
when a similarity between the collected visual user interface characteristics and the known visual user interface characteristics surpasses a predefined similarity threshold, analyze at least one additional characteristic of the software application, wherein the at least one additional characteristic comprises at least one of a digital certificate and a permissions list; and
terminate the software application and quarantine the files associated with the software application for subsequent deletion from the computing device when the at least one additional characteristic is indicative of rogue software.