Identifying whether an application is malicious

1. A processing system comprising:

a hardware processor configured to initiate executable operations comprising:

detecting the first application being presented for installation on the processing system;

scanning, via a static analysis implemented by the processor, the first application to determine whether a user interface layout of the first application is suspiciously similar to a user interface layout of a second application installed on the processing system, wherein scanning the first application comprises determining a total number of possible user interface layouts of the first application;

responsive to the static analysis being indeterminate as to whether the first application is suspiciously similar to the user interface layout of the second application, when the first application is executed, performing a runtime analysis of the first application to identify each user interface layout implemented by the first application, and determining whether each user interface layout implemented by the first application is suspiciously similar to a user interface layout of the second application; and

responsive to the runtime analysis indicating that a total number of the first application user interface layouts detected by the runtime analysis equals the total number of possible user interface layouts determined by the static analysis, and that each of the first application user interface layouts is not suspiciously similar to the user interface layout of the second application installed on the processing system, identifying the first application as being safe.

2. The processing system of claim 1 , wherein the processor further is configured to initiate executable operations comprising:

responsive to the static analysis being indeterminate as to whether the user interface layout of the first application is suspiciously similar to the user interface layout of the second application:

during execution of the first application by the processing system, performing a runtime analysis of the first application, the runtime analysis comprising determining whether the user interface layout of the first application is suspiciously similar to the user interface layout of the second application; and

responsive to the runtime analysis indicating that the user interface layout of the first application is suspiciously similar to the user interface layout of the second application, generating the alert indicating that the first application is malicious.

3. The processing system of claim 2 , wherein the processor further is configured to initiate executable operations comprising:

responsive to the runtime analysis indicating that the user interface layout of the first application is suspiciously similar to the user interface layout of the second application, preventing the first application from storing or communicating information received from user inputs received by the processing system.

4. The processing system of claim 2 , wherein performing the runtime analysis of the first application further comprises:

determining whether the first application at runtime attempts to, or requests, access at least one inter-process communication that contains private information; and

responsive to determining the first application at runtime attempts, or requests, to access the at least one inter-process communication that contains private information, determining that the first application is malicious.

5. The processing system of claim 2 , wherein performing the runtime analysis of the first application to determine whether the user interface layout of the first application is suspiciously similar to the user interface layout of the second application comprises:

determining, at runtime of the first application, whether a current user interface layout of the first application is suspiciously similar to the user interface layout of the second application; and

responsive to determining that the current user interface layout of the first application is not suspiciously similar to the user interface layout of the second application:

determining, at runtime of the first application, whether a next user interface layout of the first application is suspiciously similar to the user interface layout of the second application.

6. The processing system of claim 1 , wherein scanning the first application via the static analysis implemented by the processor further comprises:

determining whether the first application is configured to attempt to, or request, access at least one inter-process communication that contains private information; and

responsive to determining that the first application is configured to attempt to, or request, access the at least one inter-process communication that contains private information, determining that the first application is malicious.

7. A computer program product for identifying whether a first application is malicious, the computer program product comprising:

a computer-readable storage device, wherein the computer-readable storage device is not a transitory, propagating signal per se, having stored thereon program code that, when executed, configures a processor to perform executable operations comprising:

detecting the first application being presented for installation on a processing system;

scanning, via a static analysis implemented by a processor, the first application to determine whether a user interface layout of the first application is suspiciously similar to a user interface layout of a second application installed on the processing system, wherein scanning the first application comprises determining a total number of possible user interface layouts of the first application;

responsive to the static analysis being indeterminate as to whether the first application is suspiciously similar to the user interface layout of the second application, when the first application is executed, performing a runtime analysis of the first application to identify each user interface layout implemented by the first application, and determining whether each user interface layout implemented by the first application is suspiciously similar to a user interface layout of the second application; and

responsive to the runtime analysis indicating that a total number of the first application user interface layouts detected by the runtime analysis equals the total number of possible user interface layouts determined by the static analysis, and that each of the first application user interface layouts is not suspiciously similar to the user interface layout of the second application installed on the processing system, identifying the first application as being safe.

8. The computer program product of claim 7 , wherein the program code further configures the processor to perform executable operations comprising:

responsive to the static analysis being indeterminate as to whether the user interface layout of the first application is suspiciously similar to the user interface layout of the second application:

during execution of the first application by the processing system, performing a runtime analysis of the first application, the runtime analysis comprising determining whether the user interface layout of the first application is suspiciously similar to the user interface layout of the second application; and

responsive to the runtime analysis indicating that the user interface layout of the first application is suspiciously similar to the user interface layout of the second application, generating the alert indicating that the first application is malicious.

9. The computer program product of claim 8 , wherein the program code further configures the processor to perform executable operations comprising:

responsive to the runtime analysis indicating that the user interface layout of the first application is suspiciously similar to the user interface layout of the second application, preventing the first application from storing or communicating information received from user inputs received by the processing system.

10. The computer program product of claim 8 , wherein performing the runtime analysis of the first application further comprises:

determining whether the first application at runtime attempts to, or requests, access at least one inter-process communication that contains private information; and

responsive to determining the first application at runtime attempts, or requests, to access the at least one inter-process communication that contains private information, determining that the first application is malicious.

11. The computer program product of claim 8 , wherein performing the runtime analysis of the first application to determine whether the user interface layout of the first application is suspiciously similar to the user interface layout of the second application comprises:

determining, at runtime of the first application, whether a current user interface layout of the first application is suspiciously similar to the user interface layout of the second application; and

responsive to determining that the current user interface layout of the first application is not suspiciously similar to the user interface layout of the second application:

determining, at runtime of the first application, whether a next user interface layout of the first application is suspiciously similar to the user interface layout of the second application.

12. The computer program product of claim 7 , wherein scanning the first application via the static analysis implemented by the processor further comprises:

determining whether the first application is configured to attempt to, or request, access at least one inter-process communication that contains private information; and

responsive to determining that the first application is configured to attempt to, or request, access the at least one inter-process communication that contains private information, determining that the first application is malicious.