Application malware filtering for advertising networks

1. A system for application (“app”) malware filtering for advertising (“ad”) networks, comprising:

a hardware processor of a cloud service for ad network providers for automatically detecting malware apps being distributed through an ad network, the hardware processor configured to:

receive ad content;

generate a hash of the ad content;

determine whether the ad content has been previously analyzed by the cloud service based on a match of the hash of the ad content;

if the ad content has not been previously analyzed by the cloud service, then process the ad content, comprising:

determine whether the ad content includes a link to an app; and

in the event that the ad content includes the link to the app, scan the app, comprising:

determine an attribute of the app, wherein the attribute includes at least one of a behavior, a feature, or a category;

determine whether the ad content is associated with a malicious app based on the processing of the ad content and based on a policy, comprising to:

perform a dynamic analysis of the ad content to determine whether the ad content is associated with the malicious app, comprising to:

monitor internal and external app application program interface (API) calls performed by the app during execution to monitor at least one behavior of the app; and

determine whether the at least one monitored behavior exceeds or is outside scope of authorization of the app; and

perform an action based on the policy; and

a memory coupled to the hardware processor and configured to provide the hardware processor with instructions.

2. The system recited in claim 1 , wherein the hardware processor is further configured to:

if the ad content has been previously analyzed by the cloud service, then determine a previous result of the analysis of the ad content previously performed by the cloud service.

3. The system recited in claim 2 , wherein the hardware processor is further configured to:

if the ad content has been previously analyzed by the cloud service, then determine whether to process the ad content to generate an updated result or to return a previous result of the analysis of the ad content previously performed by the cloud service.

4. The system recited in claim 1 , wherein the hardware processor is further configured to:

determine whether the app is unsafe or on a blacklist based on the policy.

5. The system recited in claim 1 , wherein determine whether the ad content is associated with a malicious app based on the processing of the ad content, further comprises:

assign a probability score to the ad content based on the attribute of the app;

determine whether the probability score exceeds a threshold value; and

in the event that the probability score exceeds the threshold value, determine the ad content is associated with the malicious app.

6. The system recited in claim 1 , wherein the hardware processor is further configured to:

determine that the ad content is associated with an in-app purchase that is associated with the malicious app, the in-app purchase relating to a purchase made within the malicious app.

7. The system recited in claim 1 , wherein the policy comprises an enterprise policy configured for an entity, and wherein the hardware processor is further configured to:

determine that the ad content is associated with malicious or undesirable content based on the enterprise policy, wherein the enterprise policy comprises a plurality of rules for apps based on one or more allowable features or behaviors of apps.

8. The system recited in claim 1 , wherein the hardware processor is further configured to:

perform a static analysis of the ad content.

9. The system recited in claim 1 , wherein perform a dynamic analysis of the ad content further comprises identify any linked to apps associated with a Uniform Resource Locator (URL) embedded in the ad content, wherein the URL is a dynamically resolved URL.

10. The system recited in claim 1 , wherein perform a dynamic analysis of the ad content further comprises identify any linked to apps associated with a Uniform Resource Locator (URL) embedded in the ad content.

11. The system recited in claim 1 , wherein the hardware processor is further configured to:

determine whether the malicious app attempts to thwart malware app detection by using the ad network for app distribution.

12. The system recited in claim 1 , wherein the hardware processor is further configured to:

receive the ad content from a mobile device, wherein the mobile device is associated with an enterprise that is subscribed to the cloud service.

13. The system recited in claim 1 , wherein the hardware processor is further configured to:

receive the ad content from an ad network provider.

14. The system recited in claim 1 , wherein the hardware processor is further configured to:

receive the ad content from an ad network provider, wherein the ad content comprises a plurality of ads for analysis by the cloud service to perform batch processing of the ad content.

15. The system recited in claim 1 , wherein the feature includes app origin/source information, comments associated with the source, executable code, script or source code, an included file, a HyperText Markup Language (HTML) file, a text file, an image file, a video file, an audio file, an embedded file, a compressed archive, a certificate/signed file, an advertising identifier, a software development kit (SDK) used in the app, an authentication server identifier, or a graphical user interface (GUI)/screen shot of the app during execution.

16. The system recited in claim 1 , wherein the behavior includes toll fraud, wherein toll fraud comprises sending one or more SMS messages to premium telephone numbers without consent or permission of an end user of a mobile device.

17. The system recited in claim 1 , wherein the behavior includes at least one of location tracking, recording, access to content, or toll fraud.

18. The system recited in claim 1 , wherein the action comprises blocking or filtering the ad content based on a violation of the policy.

19. The system recited in claim 1 , wherein the action comprises tagging the ad content for further analysis by the cloud service.

20. A method of application (“app”) malware filtering for advertising (“ad”) networks, comprising:

receiving ad content;

generating a hash of the ad content;

determining whether the ad content has been previously analyzed by a cloud service based on a match of the hash of the ad content;

if the ad content has not been previously analyzed by the cloud service, then processing the ad content using a processor of a cloud service for ad network providers for automatically detecting malware apps being distributed through an ad network, comprising:

determining whether the ad content includes a link to an app; and

in the event that the ad content includes the link to the app, scanning the app, comprising:

determining an attribute of the app, wherein the attribute includes at least one of a behavior, a feature, or a category;

determining whether the ad content is associated with a malicious app based on the processing of the ad content and based on a policy, comprising:

performing a dynamic analysis of the ad content to determine whether the ad content is associated with the malicious app, comprising to:

monitoring internal and external app application program interface (API) calls performed by the app during execution to monitor at least one behavior of the app; and

determining whether the at least one monitored behavior exceeds or is outside scope of authorization of the app; and

performing an action based on the policy.

21. The system recited in claim 1 , wherein the hardware processor is further configured to:

perform a static analysis of the ad content, comprising to:

inspect byte code or assembly language of the app to determine what the app does.