Quantifying the risks of applications for mobile devices

1. A system for quantifying risks of applications (“apps”) for mobile devices, comprising:

a processor configured to:

receive an application for a mobile device;

perform a pre-screening phase that includes checking an application cache, wherein the application cache includes previously determined risk scores for previously analyzed apps;

in the event that a previously determined risk score of the application is not returned based at least in part on the pre-screening phase, perform an automated analysis of the application based on a risk profile, wherein the risk profile is based on an enterprise policy that includes custom rules for scanning of apps based on security requirements to determine whether the application includes previously known malware, exhibits new malware behaviors, poses a privacy or security risk, or any combination thereof;

generate a risk score based on the automated analysis of the application based on the risk profile; and

perform an action based on the risk score; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein perform the action based on the risk score includes:

report the risk score.

3. The system recited in claim 1 , wherein the processor is further configured to:

determine whether the application is in violation of the enterprise policy, wherein the enterprise policy includes a malware policy for apps.

4. The system recited in claim 1 , wherein the processor is further configured to:

customize the risk score based on a customized risk scoring profile, wherein the customized risk scoring profile includes an enterprise-based customization.

5. The system recited in claim 1 ,

wherein the application cache includes risk scores for previously analyzed apps that are available from a public app store.

6. The system recited in claim 1 , wherein the processor is further configured to:

respond to an app query using the application cache.

7. The system recited in claim 1 ,

wherein checking the application cache includes:

determine whether the application has been previously analyzed; and

in the event that the application has been previously analyzed, determine whether to return the previously determined risk score of the application.

8. The system recited in claim 1 , wherein the processor is further configured to:

query public app market data relating to the application, the public app market data including an application description, an application ranking in a store, a vendor reputation of the application, or any combination thereof.

9. The system recited in claim 1 , wherein the processor is further configured to:

extract metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof; and

query public app market data relating to the application based on the extracted metadata associated with the application, the public app market data including an application description, an application ranking in a store, a vendor reputation of the application, or any combination thereof.

10. The system recited in claim 1 , wherein the processor is further configured to:

upload the application from a private app store to perform the automated analysis of the application based on the risk profile.

11. The system recited in claim 1 , wherein the processor is further configured to:

upload the application from a private app store to perform the automated analysis of the application based on the risk profile, wherein the application is marked as private and is hidden from global application cache queries performed during a pre-screening phase.

12. The system recited in claim 1 , wherein the processor is further configured to:

determine whether the application performs one or more of sending text/SMS messages without user's permission or using GPS/location services without user's permission.

13. The system recited in claim 1 , wherein the processor is further configured to:

determine a reputation associated with the application.

14. The system recited in claim 1 , wherein the processor is further configured to:

perform a static analysis on the application during the automated analysis of the application based on the risk profile.

15. The system recited in claim 1 , wherein the processor is further configured to:

perform a dynamic analysis on the application during the automated analysis of the application based on the risk profile.

16. The system recited in claim 1 , wherein the processor is further configured to:

perform a dynamic analysis on the application during the automated analysis of the application based on the risk profile, wherein performing the dynamic analysis includes simulating a plurality of behaviors of the application during execution on a mobile device platform.

17. A method of quantifying risks of applications (“apps”) for mobile devices, comprising:

receiving an application for a mobile device;

performing a pre-screening phase that includes checking an application cache, wherein the application cache includes previously determined risk scores for previously analyzed apps;

in the event that a previously determined risk score of the application is not returned based at least in part on the pre-screening phase, performing an automated analysis of the application based on a risk profile, wherein the risk profile is based on an enterprise policy that includes custom rules for scanning of apps based on security requirements to determine whether the application includes previously known malware, exhibits new malware behaviors, poses a privacy or security risk, or any combination thereof;

generating a risk score based on the automated analysis of the application based on the risk profile; and

performing an action based on the risk score.

18. The method of claim 17 , wherein performing the action based on the risk score includes:

reporting the risk score.

19. The method of claim 17 , further comprising:

determining whether the application is in violation of the enterprise policy, wherein the enterprise policy includes a malware policy for apps.

20. The method of claim 17 , further comprising:

customizing the risk score based on a customized risk scoring profile, wherein the customized risk scoring profile includes an enterprise-based customization.

21. A computer program product for quantifying risks of applications (“apps”) for mobile devices, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving an application for a mobile device;

performing a pre-screening phase that includes checking an application cache, wherein the application cache includes previously determined risk scores for previously analyzed apps;

in the event that a previously determined risk score of the application is not returned based at least in part on the pre-screening phase, performing an automated analysis of the application based on a risk profile, wherein the risk profile is based on an enterprise policy that includes custom rules for scanning of apps based on security requirements to determine whether the application includes previously known malware, exhibits new malware behaviors, poses a privacy or security risk, or any combination thereof;

generating a risk score based on the automated analysis of the application based on the risk profile; and

performing an action based on the risk score.

22. The computer program product recited in claim 21 , wherein performing the action based on the risk score includes:

reporting the risk score.

23. The computer program product recited in claim 21 , further comprising computer instructions for:

determining whether the application is in violation of the enterprise policy, wherein the enterprise policy includes a malware policy for apps.

24. The computer program product recited in claim 21 , further comprising computer instructions for:

customizing the risk score based on a customized risk scoring profile, wherein the customized risk scoring profile includes an enterprise-based customization.

25. The computer program product recited in claim 21 , further comprising computer instructions for:

responding to an app query using the application cache, wherein the application cache includes risk scores for previously analyzed apps that are available from a public app store.

26. The computer program product recited in claim 21 , wherein checking the application cache includes:

determining whether the application has been previously analyzed; and

in the event that the application has been previously analyzed, determining whether to return the previously determined risk score of the application.

27. The computer program product recited in claim 21 , further comprising computer instructions for:

extracting metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof; and

querying public app market data relating to the application based on the extracted metadata associated with the application, the public app market data including an application description, an application ranking in a store, a vendor reputation of the application, or any combination thereof.

28. The computer program product recited in claim 21 , further comprising computer instructions for:

uploading the application from a private app store to perform the automated analysis of the application based on the risk profile, wherein the application is marked as private and is hidden from global application cache queries performed during a pre-screening phase.

29. The computer program product recited in claim 21 , further comprising computer instructions for:

determining a reputation associated with the application.

30. The computer program product recited in claim 21 , further comprising computer instructions for:

performing a dynamic analysis on the application during the automated analysis of the application based on the risk profile, wherein performing the dynamic analysis includes simulating a plurality of behaviors of the application during execution on a mobile device platform.