System and methods to detect mobile credential leaks during dynamic analysis

1. A method for detecting malware, comprising:

detecting, via a processor, a user login event at an application;

monitoring, via the processor, response activity of the application based at least in part on the user login event, the monitoring comprising at least an evaluation of traffic associated with the application;

determining whether the application is a known application or an unknown application, wherein the known application includes a list of expected behaviors stored in a database repository, and the unknown application has no expected behaviors stored in the database repository;

upon determining the application is the known application:

retrieving, via a communication link, one or more expected behaviors of the application from the database repository; and

upon determining the application is the unknown application:

running a legitimate use of one or more libraries associated with the application; and

identifying, via the processor, one or more observed behaviors of the application based at least in part on the running;

dynamically comparing, via the processor, the user login event with the one or more expected behaviors associated with the application when the application is determined to be the known application, or dynamically comparing the user login event with the one or more observed behaviors when the application is determined to be the unknown application; and

determining, via the processor, whether the application is potential malware based at least in part on a result of the comparing.

2. The method of claim 1 , wherein the dynamically comparing comprises:

comparing any one or more of server traffic, or application text, or application icons, or server Uniform Resource Locators (URLs), or required libraries associated with the user login event with a database of known one or more expected behaviors associated with the application.

3. The method of claim 2 , wherein the dynamically comparing further comprises:

decrypting the server traffic.

4. The method of claim 1 , wherein detecting the user login event comprises:

detecting one or more expected behaviors associated with a login event.

5. The method of claim 4 , wherein the one or more expected behaviors associated with the login event comprise any one or more of server traffic, or application text, or application icons, or server URLs, or required libraries.

6. The method of claim 1 , wherein the dynamically comparing comprises:

dynamically analyzing one or more behaviors associated with the legitimate use of the one or more libraries associated with the application; and

comparing any one or more of server traffic, or application text, or application icons, or server URLs, or required libraries associated with the user login event with the analyzed one or more behaviors associated with the legitimate use of the one or more libraries associated with the application.

7. The method of claim 1 , further comprising:

upon determining the application is potential malware, reporting the potential malware to the user.

8. The method of claim 7 , wherein reporting the potential malware to the user comprises:

detecting that the user login event has resulted in communication of one or more user login details to the malware application; and

reporting that communication to the user.

9. An apparatus for detecting malware comprising:

a processor;

a memory in electronic communication with the processor, wherein the memory stores computer readable executable instructions that when executed by the processor cause the processor to:

detect, via a processor, a user login event at an application;

monitor, via the processor, response activity of the application based at least in part on the user login event, the monitoring comprising at least an evaluation of traffic associated with the application;

determine whether the application is a known application or an unknown application, wherein the known application includes a list of expected behaviors stored in a database repository, and the unknown application has no expected behaviors stored in the database repository;

upon determining the application is the known application:

retrieve, via a communication link, one or more expected behaviors of the application from the database repository; and

upon determining the application is the unknown application:

run a legitimate use of one or more libraries associated with the application; and

identify, via the processor, one or more observed behaviors of the application based at least in part on the running;

dynamically compare, via the processor, the user login event with the one or more expected behaviors associated with the application when the application is determined to be the known application, or dynamically comparing the user login event with the one or more observed behaviors when the application is determined to be the unknown application; and

determine, via the processor, whether the application is potential malware based at least in part on a result of the comparing.

10. The apparatus of claim 9 , wherein the instructions to dynamically compare are further executable by the processor to:

compare any one or more of server traffic, or application text, or application icons, or server Uniform Resource Locators (URLs), or required libraries associated with the user login event with a database of known one or more expected behaviors associated with the application.

11. The apparatus of claim 10 , wherein the instructions to dynamically compare are further executable by the processor to:

decrypt the server traffic.

12. The apparatus of claim 9 , wherein the instructions to detect the user login event are further executable by the processor to:

detect one or more expected behaviors associated with a login event.

13. The apparatus of claim 9 , wherein the instructions to dynamically compare are further executable by the processor to:

dynamically analyze one or more behaviors associated with the legitimate use of the one or more libraries associated with the application; and

compare any one or more of server traffic, or application text, or application icons, or server URLs, or required libraries associated with the user login event with the analyzed one or more behaviors associated with the legitimate use of the one or more libraries associated with the application.

14. The apparatus of claim 9 , wherein upon determining the application is potential malware, the instructions are further executable by processor to:

report the potential malware to the user.

15. The apparatus of claim 14 , wherein the instructions to report the potential malware to the user are further executable by the processor to:

detect that the user login event has resulted in communication of one or more user login details to the malware application; and

report that communication to the user.

16. The apparatus of claim 9 , further comprising a non-transitory computer-readable storage medium storing instructions executable by the processor to:

detect, via a processor, a user login event at an application;

monitor, via the processor, response activity of the application based at least in part on the user login event, the monitoring comprising at least an evaluation of traffic associated with the application;

determine whether the application is a known application or an unknown application, wherein the known application includes a list of expected behaviors stored in a database repository, and the unknown application has no expected behaviors stored in the database repository;

upon determining the application is the known application:

retrieve, via a communication link, one or more expected behaviors of the application from the database repository; and

upon determining the application is the unknown application:

run a legitimate use of one or more libraries associated with the application; and

identify, via the processor, one or more observed behaviors of the application based at least in part on the running;

dynamically compare, via the processor, the user login event with the one or more expected behaviors associated with the application when the application is determined to be the known application, or dynamically comparing the user login event with the one or more observed behaviors when the application is determined to be the unknown application; and

determine, via the processor, whether the application is potential malware based at least in part on a result of the comparing.