System for testing computer application

1. A method comprising:

applying at least one test routine to a computer program application and testing for known suspicious behavior associated with the computer program application, wherein said applying the at least one test routine comprises installing the computer program application on a server computer, executing the computer program application on the server computer, monitoring operation of the computer program application on the server computer, and comparing the operation with the known suspicious behavior, wherein the monitoring the operation of the computer program application comprises:

capturing encrypted data transferred by said computer program application by directing a man-in-the-middle attack to a communication connection established by the computer program application; and

determining, based on the captured data, whether or not the computer program application comprises the known suspicious behavior;

creating a test report of the monitoring and the comparing;

detecting a change in at least one of a definition or version of the testing;

determining that the change has an effect on the test report that requires reapplying the at least one test routine in order to derive the effect;

reapplying the at least one test routine to the computer program application; and

upon determining that the change in the definition or version of the testing causes a change in contents of the test report, creating a new test report that includes the effect of the change.

2. The method of claim 1 , further comprising:

providing the computer program application with a public key and indicating that the public key belongs to a host to which the computer program application established the communication connection; and

providing, in connection with the public key, the computer program application with a root certificate that verifies that the public key belongs to the host.

3. The method of claim 1 , wherein applying the at least one test routine comprises:

identifying libraries referenced by the computer program application;

cross-referencing a library database storing known suspicious features of libraries with the libraries referenced in the computer program application; and

determining whether or not the computer program application comprises a known suspicious feature.

4. The method of claim 3 , further comprising:

storing character strings that characterize each library searched from the computer program application;

searching a computer program code of the computer program application for the stored character strings; and

determining the libraries referenced in the computer program application on a basis of the character strings found in the computer program code of the computer program application.

5. The method of claim 1 , wherein said applying the at least one test routine comprises:

installing the computer program application on the server computer;

executing the computer program application; and

monitoring operation of the computer program application and comparing the operation with the known suspicious behavior.

6. The method of claim 1 , wherein said applying the at least one test routine comprises:

searching the computer program application for computer program licenses associated with said computer program application; and

determining whether or not a license associated with the computer program application comprises a known suspicious feature.

7. The method of claim 1 , further comprising:

installing the computer program application in at least one of a virtual machine, an emulator, the server computer, a client computer, or a user device.

8. A system, comprising:

memory and at least one computer processor coupled thereto and configured to:

apply at least one test routine to a computer program application and testing for known suspicious behavior associated with the computer program application, wherein to apply the at least one test routine, the at least one computer processor is further configured to install the computer program application on a server computer, execute the computer program application on the server computer, monitor operation of the computer program application on the server computer, and compare the operation with the known suspicious behavior, wherein to monitor the operation of the computer program application, the at least one computer processor is further configured to:

capture encrypted data transferred by said computer program application by directing a man-in-the-middle attack to a communication connection established by the computer program application; and

determine, based on the captured data, whether or not the computer program application comprises the known suspicious behavior;

create a test report of the monitoring and the comparing;

detect a change in at least one of a definition or version of the testing;

determine that the change has an effect on the test report that requires reapplying the at least one test routine in order to derive the effect;

reapply the at least one test routine to the computer program application; and

upon a determination that the change in the definition or version of the testing causes a change in contents of the test report, create a new test report that includes the effect of the change.

9. The system of claim 8 , the at least one computer processor further configured to:

provide the computer program application with a public key and indicate that the public key belongs to a host to which the computer program application established the communication connection; and

provide, in connection with the public key, the computer program application with a root certificate that verifies that the public key belongs to the host.

10. The system of claim 8 , wherein to apply the at least one test routine, the at least one computer processor is further configured to:

identify libraries referenced by the computer program application;

cross-reference a library database storing known suspicious features of libraries with the libraries referenced in the computer program application; and

determine whether or not the computer program application comprises a known suspicious feature.

11. The system of claim 10 , the at least one computer processor further configured to:

store character strings that characterize each library searched from the computer program application;

search a computer program code of the computer program application for the stored character strings; and

determine the libraries referenced in the computer program application on a basis of the character strings found in the computer program code of the computer program application.

12. The system of claim 8 , wherein to apply the at least one test routine, the at least one computer processor is further configured to:

install the computer program application on the server computer;

execute the computer program application; and

monitor operation of the computer program application and compare the operation with the known suspicious behavior.

13. The system of claim 8 , wherein to apply the at least one test routine, the at least one computer processor is further configured to:

search the computer program application for computer program licenses associated with said computer program application; and

determine whether or not a license associated with the computer program application comprises a known suspicious feature.

14. The system of claim 8 , further comprising:

at least one of a virtual machine, an emulator, the server computer, a client computer, or a user device, configured to run the computer program application.

15. A non-transitory computer-readable storage device comprising instructions stored thereon that, when executed by at least one computer processor, cause the at least one computer processor to perform operations comprising:

applying at least one test routine to a computer program application and testing for known suspicious behavior associated with the computer program application, wherein said applying the at least one test routine comprises installing the computer program application on a server computer, executing the computer program application on the server computer, monitoring operation of the computer program application on the server computer, and comparing the operation with the known suspicious behavior, wherein the monitoring the operation of the computer program application comprises:

capturing encrypted data transferred by said computer program application by directing a man-in-the-middle attack to a communication connection established by the computer program application; and

determining, based on the captured data, whether or not the computer program application comprises the known suspicious behavior;

creating a test report of the monitoring and the comparing;

detecting a change in at least one of a definition or version of the testing;

determining that the change has an effect on the test report that requires reapplying the at least one test routine in order to derive the effect;

reapplying the at least one test routine to the computer program application;

upon determining that the change in the definition or version of the testing causes a change in contents of the test report, creating a new test report that includes the effect of the change.

16. The non-transitory computer-readable storage device of claim 15 , the operations further comprising:

providing the computer program application with a public key and indicating that the public key belongs to a host to which the computer program application established the communication connection; and

providing, in connection with the public key, the computer program application with a root certificate that verifies that the public key belongs to the host.

17. The non-transitory computer-readable storage device of claim 15 , wherein the applying the at least one test routine further comprises operations comprising:

identifying libraries referenced by the computer program application;

cross-referencing a library database storing known suspicious features of libraries with the libraries referenced in the computer program application; and

determining whether or not the computer program application comprises a known suspicious feature.

18. The non-transitory computer-readable storage device of claim 17 , the operations further comprising:

storing character strings that characterize each library searched from the computer program application;

searching a computer program code of the computer program application for the stored character strings; and

determining the libraries referenced in the computer program application on a basis of the character strings found in the computer program code of the computer program application.

19. The non-transitory computer-readable storage device of claim 15 , wherein the applying the at least one test routine further comprises operations comprising:

installing the computer program application on the server computer;

executing the computer program application; and

monitoring operation of the computer program application and comparing the operation with the known suspicious behavior.

20. The non-transitory computer-readable storage device of claim 15 , wherein the applying the at least one test routine further comprises operations comprising:

searching the computer program application for computer program licenses associated with said computer program application; and

determining whether or not a license associated with the computer program application comprises a known suspicious feature.