Systems and methods for detecting inter-personal attack applications

1. A computer-implemented method for detecting inter-personal attack applications, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

receiving, at the computing device and from an application marketplace, feature information describing a feature of an application;

creating, by performing natural language processing on the feature information, a feature vector identifying a potentially malicious functionality of the application;

creating a profiling vector that is a categorical feature representation of installation information from an installation file of the application; and

performing a security action comprising:

mapping, using a machine learning model, the feature vector and the profiling vector to a multi-dimensional output vector, wherein each element of the multi-dimensional output vector corresponds to a malware category; and

determining an extent of maliciousness of the application by combining the categories identified by the multi-dimensional output vector with bi-partite graph information identifying:

relations between a plurality of applications; and

relations between a plurality of computing devices hosting the plurality of applications.

2. The computer-implemented method of claim 1 , wherein the feature information comprises at least one of a title of the application, a description of the application, and user comment information about the application.

3. The computer-implemented method of claim 1 , wherein creating the feature vector comprises:

extracting distributional characteristics of key words in the feature information by applying a bag-of-words technique to the feature information;

removing a frequently used word from the feature information to create modified feature information; and

identifying a latent topic of the modified feature information by using latent semantic indexing, wherein the latent topic describes the potentially malicious functionality of the application.

4. The computer-implemented method of claim 1 , further comprising:

calculating a distance between the feature vector of the application and an additional feature vector of an additional application, wherein the additional application is located at another computing device and has a known degree of maliciousness; and

identifying the potentially malicious functionality of the application based on the calculated distance.

5. The computer-implemented method of claim 1 , wherein creating the profiling vector comprises extracting installation information identifying an application programming interface call that the application is configured to make.

6. The computer-implemented method of claim 1 , wherein the installation information comprises permissions to access at least one of:

a camera of the computing device;

a microphone of the computing device;

a speaker of the computing device; and

information identifying a location of the computing device.

7. The computer-implemented method of claim 1 , wherein the installation information comprises information describing a digital certificate.

8. The computer-implemented method of claim 1 , wherein the machine learning model is a gradient-boosted tree-based multiple-output classifier configured to perform multi-label classification.

9. The computer-implemented method of claim 1 , wherein the malware categories comprise a surveillance malware category.

10. The computer-implemented method of claim 1 , further comprising using a belief propagation algorithm to create the bi-partite graph information.

11. The computer-implemented method of claim 1 , wherein the application is in the plurality of applications.

12. The computer-implemented method of claim 1 , further comprising displaying, on a user display, an indication of the extent of maliciousness of the application that comprises:

information describing the potentially malicious functionality of the application; and

an indication the application is an inter-personal attack application.

13. The computer-implemented method of claim 1 , further comprising sending information describing the extent of maliciousness of the application to another computing device.

14. A system for detecting inter-personal attack applications, the system comprising:

a physical processor; and

a physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:

receive, at the system and from an application marketplace, feature information describing a feature of an application;

create, by performing natural language processing on the feature information, a feature vector identifying a potentially malicious functionality of the application;

create a profiling vector that is a categorical feature representation of installation information from an installation file of the application; and

perform a security action comprising:

mapping, using a machine learning model, the feature vector and the profiling vector to a multi-dimensional output vector, wherein each element of the multi-dimensional output vector corresponds to a malware category; and

determining an extent of maliciousness of the application by combining the categories identified by the multi-dimensional output vector with bi-partite graph information identifying:

relations between a plurality of applications; and

relations between a plurality of computing devices hosting the plurality of applications.

15. The system of claim 14 , wherein the machine learning model is a gradient-boosted tree-based multiple-output classifier configured to perform multi-label classification.

16. The system of claim 14 , wherein the computer-executable instructions, when executed by the at last one physical processor, cause the at least one physical processor to display, on a user display, an indication of the extent of maliciousness of the application that comprises:

information describing the potentially malicious functionality of the application; and

an indication the application is an inter-personal attack application.

17. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

receive, at the computing device and from an application marketplace, feature information describing a feature of an application;

create, by performing natural language processing on the feature information, a feature vector identifying a potentially malicious functionality of the application;

create a profiling vector that is a categorical feature representation of installation information from an installation file of the application; and

perform a security action comprising:

mapping, using a machine learning model, the feature vector and the profiling vector to a multi-dimensional output vector, wherein each element of the multi-dimensional output vector corresponds to a malware category; and

determining an extent of maliciousness of the application by combining the categories identified by the multi-dimensional output vector with bi-partite graph information identifying:

relations between a plurality of applications; and

relations between a plurality of computing devices hosting the plurality of applications.

18. The non-transitory computer-readable medium of claim 17 , wherein the machine learning model is a gradient-boosted tree-based multiple-output classifier configured to perform multi-label classification.

19. The non-transitory computer-readable medium of claim 17 , further comprising computer-executable instructions that, when executed by the at least one processor, cause the computing device to display, on a user display, an indication of the extent of maliciousness of the application that comprises:

information describing the potentially malicious functionality of the application; and

an indication the application is an inter-personal attack application.