Quantifying the risks of applications for mobile devices

1. A system for quantifying risks of applications (“apps”) for mobile devices, comprising:

a processor configured to:

receive an application for a mobile device;

perform an automated analysis of the application based on a risk profile, wherein perform the automated analysis of the application based on the risk profile includes:

perform a dynamic analysis on the application based on the risk profile, wherein perform the dynamic analysis includes simulating a plurality of behaviors of the application during execution on a mobile device platform, wherein the dynamic analysis on the application is a run-time emulation performed using an instrumented emulation environment that simulates an app execution environment for mobile devices;

generate a risk score based on the automated analysis of the application based on the risk profile and any malware behaviors, privacy behaviors, and/or risky behaviors identified during the automated analysis of the application; and

perform an action based on the risk score, wherein perform the action based on the risk score includes:

report the risk score, generate a report for the application including the risk score, send a notification related to the application based on the risk score, block the application based on the risk score, or any combination thereof; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein simulating the plurality of behaviors of the application during execution on the mobile device platform includes performing an operation without user permission.

3. The system recited in claim 1 , wherein simulating the plurality of behaviors of the application during execution on the mobile device platform includes performing an SMS operation without user permission.

4. The system recited in claim 1 , wherein the processor is further configured to:

monitor internal and external API calls during the dynamic analysis.

5. The system recited in claim 1 , wherein the processor is further configured to:

monitor internal and external API calls, including kernel level API calls, during the dynamic analysis.

6. The system recited in claim 1 , wherein the processor is further configured to:

monitor calls to URLs during the dynamic analysis.

7. The system recited in claim 1 , wherein the processor is further configured to:

perform a static analysis on the application during the automated analysis of the application based on the risk profile.

8. The system recited in claim 1 , wherein the processor is further configured to:

perform a static analysis on the application during the automated analysis of the application based on the risk profile, wherein information determined from the static analysis is provided as input to the dynamic analysis.

9. The system recited in claim 1 , wherein the processor is further configured to:

perform a comparison with collective app intelligence to determine an app reputation based on a URL and IP reputation during the automated analysis of the application based on the risk profile, wherein the risk score is based on the dynamic analysis, the app reputation, or any combination thereof.

10. The system recited in claim 1 , wherein the processor is further configured to:

query public application market data relating to the application, the public application market data including an application description, an application ranking in a store, a vendor reputation of the application, or any combination thereof.

11. The system recited in claim 1 , wherein the processor is further configured to:

extract metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof; and

query public application market data relating to the application based on the extracted metadata associated with the application to determine whether the application has been repackaged with malware.

12. The system recited in claim 1 , wherein the risk profile is based on an enterprise policy that includes one or more custom rules for scanning of apps based on security requirements to determine whether the application includes previously known malware, exhibits new malware behaviors, poses a privacy or security risk, or any combination thereof.

13. The system recited in claim 1 , wherein the processor is further configured to:

customize the risk score based on a customized risk scoring profile, wherein the customized risk scoring profile includes an enterprise-based customization.

14. The system recited in claim 1 , wherein the processor is further configured to:

determine whether the application is in violation of an enterprise policy, wherein the enterprise policy includes a malware policy for apps that includes one or more custom rules for scanning of apps based on security requirements to determine whether the application includes previously known malware, exhibits new malware behaviors, poses a privacy or security risk, or any combination thereof.

15. The system recited in claim 1 , wherein the processor is further configured to:

generate an enterprise risk score based on an enterprise risk profile; and

perform an action based on the enterprise risk score, wherein perform the action based on the enterprise risk score includes:

report the enterprise risk score, generate an enterprise report for the application including the enterprise risk score, send a notification related to the application based on the enterprise risk score, block the application based on the enterprise risk score, or any combination thereof.

16. The system recited in claim 1 wherein the processor is further configured to:

perform a pre-screening phase that includes checking an application cache, wherein the application cache includes previously determined risk scores for previously analyzed apps that are available from a public app store.

17. The system recited in claim 1 wherein the processor is further configured to:

perform a pre-screening phase that includes checking an application cache, wherein the application cache includes previously determined risk scores for previously analyzed apps that are available from a public app store, wherein checking the application cache includes:

determine whether the application has been previously analyzed; and

in the event that the application has been previously analyzed, determine whether to return the previously determined risk score of the application.

18. A method of quantifying risks of applications (“apps”) for mobile devices, comprising:

receiving an application for a mobile device;

performing an automated analysis of the application based on a risk profile using a processor, wherein performing the automated analysis of the application based on the risk profile includes:

performing a dynamic analysis on the application based on the risk profile, wherein performing the dynamic analysis includes simulating a plurality of behaviors of the application during execution on a mobile device platform, wherein the dynamic analysis on the application is a run-time emulation performed using an instrumented emulation environment that simulates an app execution environment for mobile devices;

generating a risk score based on the automated analysis of the application based on the risk profile and any malware behaviors, privacy behaviors, and/or risky behaviors identified during the automated analysis of the application; and

performing an action based on the risk score, wherein performing the action based on the risk score includes:

reporting the risk score, generating a report for the application including the risk score, sending a notification related to the application based on the risk score, blocking the application based on the risk score, or any combination thereof.

19. The method of claim 18 , wherein simulating the plurality of behaviors of the application during execution on the mobile device platform includes performing an operation without user permission.

20. The method of claim 18 , further comprising:

monitoring internal and external API calls during the dynamic analysis.

21. The method of claim 18 , further comprising:

monitoring calls to URLs during the dynamic analysis.

22. The method of claim 18 , further comprising:

performing a static analysis on the application during the automated analysis of the application based on the risk profile, wherein information determined from the static analysis is provided as input to the dynamic analysis.

23. A computer program product for quantifying risks of applications (“apps”) for mobile devices, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving an application for a mobile device;

performing an automated analysis of the application based on a risk profile, wherein performing the automated analysis of the application based on the risk profile includes:

performing a dynamic analysis on the application based on the risk profile, wherein performing the dynamic analysis includes simulating a plurality of behaviors of the application during execution on a mobile device platform, wherein the dynamic analysis on the application is a run-time emulation performed using an instrumented emulation environment that simulates an app execution environment for mobile devices;

generating a risk score based on the automated analysis of the application based on the risk profile and any malware behaviors, privacy behaviors, and/or risky behaviors identified during the automated analysis of the application; and

performing an action based on the risk score, wherein performing the action based on the risk score includes:

reporting the risk score, generating a report for the application including the risk score, sending a notification related to the application based on the risk score, blocking the application based on the risk score, or any combination thereof.

24. The computer program product recited in claim 23 , wherein simulating the plurality of behaviors of the application during execution on the mobile device platform includes performing an operation without user permission.

25. The computer program product recited in claim 23 , further comprising computer instructions for:

monitoring internal and external API calls during the dynamic analysis.

26. The computer program product recited in claim 23 , further comprising computer instructions for:

monitoring calls to URLs during the dynamic analysis.

27. The computer program product recited in claim 23 , further comprising computer instructions for:

performing a static analysis on the application during the automated analysis of the application based on the risk profile, wherein information determined from the static analysis is provided as input to the dynamic analysis.