Systems and methods for utilizing multiple analysis techniques to distinguish stalkerware from privacy-invasive application types

1. A computer-implemented method for utilizing multiple analysis techniques to distinguish stalkerware from privacy-invasive application types, at least a portion of the method being performed by one or more computing devices comprising at least one processor, the method comprising:

inspecting, by the one or more computing devices, application package data associated with a target application;

analyzing, by the one or more computing devices, application marketplace data comprising text and image data for the target application to determine one or more descriptions of potential privacy-invasive actions;

predicting, by the one or more computing devices and utilizing a program machine learning classifier, one or more sensitive data leaks associated with the target application based on the application package data;

predicting, by the one or more computing devices and utilizing a marketplace data machine learning classifier, surveillance activities associated with the target application based on the one or more descriptions of the potential privacy-invasive actions; and

performing, by the one or more computing devices, a security action that assigns a privacy invasion category to the target application based on the predicted one or more sensitive data leaks and the predicted surveillance activities to distinguish the target application from among a plurality of invasive application types comprising stalkerware and other privacy invasion application types.

2. The computer-implemented method of claim 1 , wherein inspecting the application package data associated with the target application comprises inspecting target application source code and target application libraries utilized for providing target application functionality.

3. The computer-implemented method of claim 2 , wherein analyzing the application marketplace data for the target application to determine the one or more descriptions of privacy-invasive actions comprises analyzing at least one of:

target application titles;

target application descriptions;

target application screenshots; or

target application developer information.

4. The computer-implemented method of claim 1 , wherein the one or more descriptions of the privacy-invasive actions comprise at least one of surveillance actions and personal data collection.

5. The computer-implemented method of claim 1 , wherein predicting the one or more sensitive data leaks associated with the target application based on the application package data comprises determining a privacy information type associated with the one or more sensitive data leaks.

6. The computer-implemented method of claim 1 , wherein predicting the surveillance activities associated with the target application based on the one or more descriptions of the potential privacy-invasive actions comprises:

identifying a sensitive data collection action in the one or more descriptions of the potential privacy-invasive actions; and

determining a privacy information type associated with sensitive data collection action.

7. The computer-implemented method of claim 1 , wherein performing the security action that assigns a privacy invasion category to the target application comprises: determining whether the one or more descriptions of the potential privacy-invasive actions include surveillance activity; determining whether the descriptions of the potential privacy-invasive actions include sensitive data collection and identify sensitive data types; and determining whether the one or more sensitive data leaks are associated with the target application.

8. The computer-implemented method of claim 7 , wherein the security action assigns a stalkerware category to the target application upon determining that the one or more descriptions of the potential privacy-invasive actions include the surveillance activity and determining that the one or more sensitive data leaks are associated with the target application.

9. The computer-implemented method of claim 7 , wherein the security action assigns a fake surveillance application category to the target application upon determining that the one or more descriptions of the potential privacy-invasive actions include the surveillance activity and determining that the one or more sensitive data leaks are not associated with the target application.

10. The computer-implemented method of claim 7 , wherein the security action assigns a spyware category to the target application upon determining that the one or more descriptions of the potential privacy-invasive actions do not include the surveillance activity, determining that the one or more descriptions of the potential privacy-invasive actions do not include sensitive data collection, and determining that the one or more sensitive data leaks are associated with the target application.

11. A system for utilizing multiple analysis techniques to distinguish stalkerware from privacy-invasive application types, the system comprising:

at least one physical processor;

physical memory comprising computer-executable instructions and one or more modules that, when executed by the physical processor, cause the physical processor to:

inspect, by an inspection module, application package data associated with a target application;

analyze, by an analysis module, application marketplace data comprising text and image data for the target application to determine one or more descriptions of potential privacy-invasive actions;

predict, by a program machine learning classification module, one or more sensitive data leaks associated with the target application based on the application package data;

predict, by a marketplace data machine learning classification module, surveillance activities associated with the target application based on the one or more descriptions of the potential privacy-invasive actions; and

perform, by a security module, a security action that assigns a privacy invasion category to the target application based on the predicted one or more sensitive data leaks and the predicted surveillance activities to distinguish the target application from among a plurality of invasive application types comprising stalkerware and other privacy invasion application types.

12. The system of claim 11 , wherein the inspection module inspects the application package data associated with the target application by inspecting target application source code and target application libraries utilized for providing target application functionality.

13. The system of claim 11 , wherein the analysis module analyzes the application marketplace data for the target application to determine the one or more descriptions of privacy-invasive actions by analyzing at least one of:

target application titles;

target application descriptions;

target application screenshots; or

target application developer information.

14. The system of claim 11 , wherein the one or more descriptions of the privacy-invasive actions comprise at least one of surveillance actions and personal data collection.

15. The system claim 11 , wherein the program machine learning classification module predicts the one or more sensitive data leaks associated with the target application based on the application package data by determining a privacy information type associated with the one or more sensitive data leaks.

16. The system of claim 11 , wherein the marketplace machine classification module predicts the surveillance activities associated with the target application based on the one or more descriptions of the potential privacy-invasive actions by:

identifying a sensitive data collection action in the one or more descriptions of the potential privacy-invasive actions; and

determining a privacy information type associated with sensitive data collection action.

17. The system of claim 11 , wherein the security module performs the security action that assigns a privacy invasion category to the target application by: determining whether the one or more descriptions of the potential privacy-invasive actions include surveillance activity; determining whether the descriptions of the potential privacy-invasive actions include sensitive data collection and identify sensitive data types; and determining whether the one or more sensitive data leaks are associated with the target application.

18. The system of claim 17 , wherein the security module assigns a stalkerware category to the target application upon determining that the one or more descriptions of the potential privacy-invasive actions include the surveillance activity and determining that the one or more sensitive data leaks are associated with the target application.

19. The system of claim 17 , wherein the security module assigns a fake surveillance application category to the target application upon determining that the one or more descriptions of the potential privacy-invasive actions include the surveillance activity and determining that the one or more sensitive data leaks are not associated with the target application.

20. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

inspect application package data associated with a target application;

analyze application marketplace data comprising text and image data for the target application to determine one or more descriptions of potential privacy-invasive actions;

predict, utilizing a program machine learning classifier, one or more sensitive data leaks associated with the target application based on the application package data;

predict, utilizing a marketplace data machine learning classifier, surveillance activities associated with the target application based on the one or more descriptions of the potential privacy-invasive actions; and

perform a security action that assigns a privacy invasion category to the target application based on the predicted one or more sensitive data leaks and the predicted surveillance activities to distinguish the target application from among a plurality of invasive application types comprising stalkerware and other privacy invasion application types.