Identifying and protecting against surveillance apps installed on client devices

1. A computer-implemented method for identifying and protecting against malicious apps installed on client devices, at least a portion of the method being performed by a computer device comprising one or more processors, the method comprising:

(a) identifying client devices;

(b) identifying apps installed on the client devices;

(c) assigning each of the apps known to be a malicious app with a highest app suspicion score;

(d) assigning each of the other apps as an unknown app with a lowest app suspicion score;

(e) assigning each of the client devices with a device suspicion score equal to a maximum app suspicion score of the identified apps installed on the client device;

(f) assigning each of the unknown apps with an initially updated app suspicion score equal to an average device suspicion score of the client device(s) upon which the unknown app is installed;

(g) identifying a sum of the initially updated app suspicion scores;

(h) assigning each of the client devices with a revised device suspicion score equal to a new maximum app suspicion score of the identified apps installed on the client device;

(i) assigning each of the unknown apps with a subsequently updated app suspicion score, wherein the subsequently updated app suspicion score is based on an average of the revised device suspicion scores upon which each of the unknown apps is installed, and wherein the subsequently updated app suspicion scores include a normalization that results in a sum of the subsequently updated app suspicion scores to be equal to the sum of the initially updated app suspicion scores;

(j) repeating (h) and (i) until the device suspicion scores and the app suspicion scores converge within a convergence threshold;

(k) in response to one of the unknown apps having an app suspicion score that exceeds a suspicion threshold, identifying the unknown app as a malicious app; and

(l) in response to identifying the malicious app, protecting against the malicious app by directing performance, at one of the client devices upon which the malicious app is installed, of a remedial action to protect the client device from the malicious app.

2. The method of claim 1 , wherein the performing, at one of the client devices upon which the malicious app is installed, of a remedial action comprises one or more of blocking the client device from accessing a network, rolling back one or more changes at the client device that were made by the malicious app, quarantining the malicious app on the client device, uninstalling the malicious app from the client device, or temporarily freezing activity at the client device, or some combination thereof.

3. The method of claim 1 , wherein:

the highest app suspicion score is 1; and

the lowest app suspicion score is 0.

4. The method of claim 3 , wherein the convergence threshold is four decimal places.

5. The method of claim 1 , wherein the suspicion threshold comprises a threshold in a ranking of the app suspicion scores of the unknown apps.

6. A computer-implemented method for identifying and protecting against malicious apps installed on client devices, at least a portion of the method being performed by a computer device comprising one or more processors, the method comprising:

(a) identifying client devices;

(b) identifying apps installed on the client devices;

(c) assigning each of the apps known to be a malicious app with a highest app suspicion score;

(d) assigning each of the other apps as an unknown app with a lowest app suspicion score;

(e) assigning each of the client devices with a device suspicion score equal to a maximum app suspicion score of the identified apps installed on the client device;

(f) assigning each of the unknown apps with an initially updated app suspicion score equal to a first fraction that comprises a first numerator based on a sum of the device suspicion scores of the client devices upon which the unknown app is installed and a first denominator based on a number of the client devices upon which the unknown app is installed;

(g) identifying a sum of the initially updated app suspicion scores;

(h) assigning each of the client devices with a revised device suspicion score equal to a new maximum app suspicion score of the identified apps installed on the client device;

(i) assigning each of the unknown apps with a subsequently updated app suspicion score equal to a second fraction that comprises a second numerator based on a sum of the revised device suspicion scores of the client devices upon which the unknown app is installed and a second denominator based on a number of the client devices upon which the unknown app is installed, and wherein the subsequently updated app suspicion scores include a normalization that results in a sum of the subsequently updated app suspicion scores to be equal to the sum of the initially updated app suspicion scores;

(j) repeating (h) and (i), until the device suspicion scores and the app suspicion scores converge within a convergence threshold;

(k) in response to one of the unknown apps having an app suspicion score that exceeds a suspicion threshold, identifying the unknown app as a malicious app; and

(l) in response to identifying the malicious app, protecting against the malicious app by directing performance, at one of the client devices upon which the malicious app is installed, of a remedial action to protect the client device from the malicious app.

7. The method of claim 6 , wherein the performing, at one of the client devices upon which the malicious app is installed, of a remedial action comprises one or more of blocking the client device from accessing a network, rolling back one or more changes at the client device that were made by the malicious app, quarantining the malicious app on the client device, uninstalling the malicious app from the client device, or temporarily freezing activity at the client device, or some combination thereof.

8. The method of claim 6 , wherein:

the highest app suspicion score is 1; and

the lowest app suspicion score is 0.

9. The method of claim 6 , wherein the first and second fractions further comprise a first constant added to the first and second numerators and a second constant added to the first and second denominators in order to avoid false positives, wherein the first constant is smaller than the second constant.

10. The method of claim 6 , wherein the suspicion threshold comprises a threshold in a ranking of the app suspicion scores of the unknown apps.

11. The method of claim 6 , wherein the first and second fractions are determined using an Empirical Bayes Estimation.

12. A computer-implemented method for identifying and protecting against surveillance apps installed on client devices, at least a portion of the method being performed by a computer device comprising one or more processors, the method comprising:

(a) identifying client devices;

(b) identifying apps installed on the client devices;

(c) assigning each of the apps known to be a surveillance app with a highest app suspicion score;

(d) assigning each of the other apps as an unknown app with a lowest app suspicion score;

(e) assigning each of the client devices with a device suspicion score equal to a maximum app suspicion score of the identified apps installed on the client device;

(f) assigning each of the unknown apps with an initially updated app suspicion score equal to an average device suspicion score of the client device(s) upon which the unknown app is installed;

(g) identifying a sum of the initially updated app suspicion scores;

(h) assigning each of the client devices with a revised device suspicion score equal to a new maximum app suspicion score of the identified apps installed on the client device;

(i) assigning each of the unknown apps with a subsequently updated app suspicion score equal to a fraction that includes a numerator based on a sum of the revised device suspicion scores of the client devices upon which the unknown app is installed and a denominator based on a number of the client devices upon which the unknown app is installed, and wherein the subsequently updated app suspicion scores include a normalization that results in a sum of the subsequently updated app suspicion scores to be equal to the sum of the initially updated app suspicion scores;

(j) repeating (h) and (i), until the device suspicion scores and the app suspicion scores converge within a convergence threshold;

(k) in response to one of the unknown apps having an app suspicion score that exceeds a suspicion threshold, identifying the unknown app as a surveillance app; and

(l) in response to identifying the surveillance app, protecting against the surveillance app by directing performance, at one of the client devices upon which the surveillance app is installed, of a remedial action to protect the client device from the surveillance app.

13. The method of claim 12 , wherein the performing, at one of the client devices upon which the surveillance app is installed, of a remedial action comprises one or more of blocking the client device from accessing a network, rolling back one or more changes at the client device that were made by the surveillance app, quarantining the surveillance app on the client device, uninstalling the surveillance app from the client device, or temporarily freezing activity at the client device, or some combination thereof.

14. The method of claim 12 , wherein:

the highest app suspicion score is 1; and

the lowest app suspicion score is 0.

15. The method of claim 14 , wherein the fraction of (i) further comprises a first constant added to the numerator and a second constant added to the denominator in order to avoid false positives, wherein the first constant is smaller than the second constant.

16. The method of claim 12 , wherein the suspicion threshold comprises a threshold in a ranking of the app suspicion scores of the unknown apps.

17. The method of claim 12 , wherein the fraction comprises a fraction determined using an Empirical Bayes Estimation.