Integrated application analysis and endpoint protection
An indication of an application to be installed on a local device is received. A request is transmitted to a remote server for information associated with the application. In some cases, in response to the receipt of a report from the remote server, a set of rules restricting behaviors of the application is implemented at the local device. In some cases, in response to the receipt of a report from the remote server, the installation of the application on the local device is prevented.
1. A system, comprising:
a processor configured to:
receive an indication that an attempt is being made to install an application on a local device;
in response to receiving the indication, transmit a request to a remote server for information associated with the application;
allow limited execution at the local device of a first executing copy of the application, pending receipt of a report from the remote server, wherein the received report comprises behaviors observed as being taken by a second copy of the application executed in a virtualized environment provided by the remote server, wherein the limited execution of the first executing copy of the application that is executing on the local device has a reduced set of functionality compared to functionality that can be provided by the same application when execution is not limited during another execution of the first executing copy on the local device; and
in response to the receipt of the report from the remote server, implement, at the local device, a set of rules restricting behaviors of the application installed on the local device; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein the processor is further configured to detect an attempt by the first executing copy of the application to take an action that would violate the set of rules.
3. The system of claim 2 , wherein the set of rules comprises a whitelisted set of behaviors observed at the remote server during execution of the second copy of the application in the virtualized environment and wherein an attempt by the first executing copy of the application while executing on the local device to take an action not included in the whitelisted set of behaviors constitutes a rule violation.
4. The system of claim 2 , wherein the processor is further configured to report the attempt to a user of the local device.
5. The system of claim 2 , wherein the processor is further configured to report the attempt to the remote server.
6. The system of claim 5 , wherein, in response to receiving the report, the remote server performs an evaluation of the second copy of the application.
7. The system of claim 1 , wherein the set of rules restricts the first executing copy of the application to the behaviors observed during execution of the second copy of the application in the virtualized environment.
8. The system of claim 1 , wherein the remote server is configured to evaluate an updated version of the application in response to receiving an indication that the attempt is being made to install the updated version of the application.
9. The system of claim 1 , wherein the processor is further configured to monitor an application repository for updates made to the application.
10. The system of claim 9 , wherein the processor is configured to monitor the application repository at least in part using an application programming interface made available by the application repository.
11. The system of claim 9 , wherein the processor is configured to monitor the application repository at least in part using a crawler.
12. A method, comprising:
receiving an indication that an attempt is being made to install an application on a local device;
in response to receiving the indication, transmitting a request to a remote server for information associated with the application;
allowing limited execution at the local device of a first executing copy of the application, pending receipt of a report from the remote server, wherein the received report comprises behaviors observed as being taken by a second copy of the application executed in a virtualized environment provided by the remote server, wherein the limited execution of the first executing copy of the application that is executing on the local device has a reduced set of functionality compared to functionality that can be provided by the same application when execution is not limited during another execution of the first executing copy on the local device; and
in response to the receipt of the report from the remote server, implementing, at the local device, a set of rules restricting behaviors of the application installed on the local device.
13. The method of claim 12 , further comprising detecting an attempt by the first executing copy of the application to take an action that would violate the set of rules.
14. The method of claim 13 , wherein the set of rules comprises a whitelisted set of behaviors observed at the remote server during execution of the second copy of the application in the virtualized environment and wherein an attempt by the first executing copy of the application while executing on the local device to take an action not included in the whitelisted set of behaviors constitutes a rule violation.
15. The method of claim 13 , further comprising reporting the attempt to a user of the local device.
16. The method of claim 13 , further comprising reporting the attempt to the remote server.
17. The method of claim 16 , wherein, in response to receiving the report, the remote server performs an evaluation of the second copy of the application.
18. The method of claim 12 , wherein the set of rules restricts the first executing copy of the application to the behaviors observed during execution of the second copy of the application in the virtualized environment.
19. The method of claim 12 , wherein the remote server is configured to evaluate an updated version of the application in response to receiving an indication that the attempt is being made to install the updated version of the application.
20. The method of claim 12 , further comprising monitoring an application repository for updates made to the application.
21. The method of claim 20 , wherein monitoring the application repository includes using an application programming interface made available by the application repository.
22. The method of claim 20 , wherein monitoring the application repository includes using a crawler.