Detection of mutated apps and usage thereof

1. A method performed by a processor, wherein the method comprises:

obtaining features of an Application Under Check (AUC);

matching the AUC with a host application, wherein the host application is matched from a repository of applications that are a-priori known to be legitimate applications, wherein said matching comprises comparing the features of the AUC with sets of features of applications to determine the host application of the AUC;

determining an identical portion of the AUC and a remainder portion of the AUC, wherein the identical portion is identical to a corresponding portion in the host application, wherein the remainder portion of the AUC is not identically included in the host application;

analyzing the remainder portion to detect different functionality between the AUC and the host application;

in response to said matching, determining that the AUC is a mutated application of the host application, wherein the mutated application is a variation of the host application, wherein the mutated application is a non-legitimate application, wherein said determining comprises comparing a signature of the AUC with a signature of the host application; and in response to said determining that the AUC is a mutated application, performing a predetermined action.

2. The method of claim 1 , wherein the AUC is obtained from a non-trusted application repository.

3. The method of claim 1 , wherein the sets of features of applications are retained in a database, wherein the database is updated based on one or more trusted application repositories.

4. The method of claim 1 , wherein the sets of features of applications are retained in a database, wherein the database comprises information relating to applications installed on crowdsourced devices.

5. The method of claim 4 , wherein the database comprises information relating to popular applications based on installation information from the crowdsourced devices.

6. The method of claim 1 , wherein the mutated application is configured to perform a malicious activity that is not included in the host application.

7. The method of claim 1 , wherein the mutated application overrides a Digital Rights Management (DRM) mechanism present in the host application.

8. The method of claim 1 , wherein the mutated application replaces a module of the host application by a second module.

9. The method of claim 1 , wherein the features of the AUC comprise one or more of the following features:

a title of the AUC;

an icon of the AUC;

a splash screen content of the AUC;

a look and feel indicator of the AUC;

a name of a file in a distribution of the AUC;

content of a file in a distribution of the AUC, or hash value thereof; and

a resource comprised by a distribution of the AUC.

10. The method of claim 1 further comprises:

determining that the mutated application is a different version of the host application, wherein said determining comprises: comparing, between the host application and the AUC at least one of the following:

versioning information;

vendor identification; and

signing certification.

11. The method of claim 1 , wherein the features of the AUC comprise a User Interface (UI) layout of the AUC.

12. A server being connected to a network, wherein the server comprises:

a memory; and

a processor adapted to perform the steps of:

collecting features relating to trusted applications, wherein the trusted applications are potentially useable as a basis for a mutated application, wherein the mutated application is a variation of a host application selected from the trusted applications, wherein the mutated application is a non-legitimate application, wherein the features are features that are indicative of mutated versions of the trusted applications;

retaining the features in a repository, whereby collecting and retaining a list of positive signatures of trusted applications that are useful to approximately identify a host application of a mutated application, whereby enabling the use of a collection of trusted applications to be used as an indication that an application under check (AUC) is a non-legitimate application, wherein the indication is matching the application under check with a trusted application;

determining an identical portion of the AUC and a remainder portion of the AUC, wherein the identical portion is identical to a corresponding portion in the host application, wherein the remainder portion of the AUC is not identically included in the host application; and

analyzing the remainder portion to detect different functionality between the AUC and the host application.

13. The server of claim 12 , wherein said collecting comprises:

downloading the trusted applications from one or more trusted application repositories; and

extracting the features from the downloaded trusted applications.

14. The server of claim 12 , wherein said collecting comprises:

obtaining indications from a plurality of computing devices relating to applications that are installed on the plurality of computing devices;

identifying one or more applications that have a statistical measurement above a predetermined threshold, wherein the identified one or more applications are the trusted applications; and

obtaining the features of the trusted applications.

15. The server of claim 14 , wherein said obtaining the features of the trusted applications comprises: receiving from a computing device the features, wherein the computing device extracts the features from the trusted application installed thereon.

16. The server of claim 14 , wherein said obtaining the features of the trusted applications comprises:

receiving from one or more additional computing devices the features, wherein the one or more computing devices extract the features from the trusted application installed thereon, wherein a malicious attempt to provide false features is detectable; and

selecting from the obtained features of a same trusted application.

17. The server of claim 14 , wherein at least a portion of the applications are purchased applications and are restricted from being transferred to another device.

18. A computer program product comprising a non-transitory computer-readable storage medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform the following:

obtain features of an Application Under Check (AUC);

match the AUC with a host application, wherein the host application is matched from a repository of applications that are a-priori known to be legitimate applications, wherein the matching comprises comparing the features of the AUC with sets of features of applications to determine the host application of the AUC;

determine an identical portion of the AUC and a remainder portion of the AUC, wherein the identical portion is identical to a corresponding portion in the host application, wherein the remainder portion of the AUC is not identically included in the host application;

analyze the remainder portion to detect different functionality between the AUC and the host application;

in response to matching the AUC with the host application, determine that the AUC is a mutated application of the host application by comparing a signature of the AUC with a signature of the host application; and

in response to said determining that the AUC is a mutated application, perform a predetermined action.

19. An apparatus comprising the processor and a memory, said memory retaining the program instructions of claim 18 .