Quantifying the risks of applications for mobile devices

1. A system for quantifying risks of applications (“apps”) for mobile devices, comprising:

a processor configured to:

receive an application for a mobile device;

perform an automated analysis of the application based on a risk profile, wherein perform the automated analysis of the application based on the risk profile includes:

query public application (“app”) market data relating to the application, the public app market data including an application description, an application ranking in a store, a vendor reputation of the application, or any combination thereof; and

perform a dynamic analysis on the application based on the risk profile, wherein perform the dynamic analysis includes simulating a plurality of behaviors of the application during execution on a mobile device platform;

generate a risk score based on the automated analysis of the application based on the risk profile; and

perform an action based on the risk score, wherein perform the action based on the risk score includes:

report the risk score, generate a report for the application including the risk score, send a notification related to the application based on the risk score, block the application based on the risk score, or any combination thereof; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the processor is further configured to:

extract metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof; and

query public app market data relating to the application based on the extracted metadata associated with the application.

3. The system recited in claim 1 , wherein the processor is further configured to:

extract metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof; and

query public app market data relating to the application based on the extracted metadata associated with the application to determine whether the application has been repackaged with malware.

4. The system recited in claim 1 , wherein the processor is further configured to:

extract metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof, wherein extract metadata associated with the application includes:

deobfuscate and parse a manifest of the application to extract the metadata associated with the application; and

query public app market data relating to the application based on the extracted metadata associated with the application.

5. The system recited in claim 1 , wherein the risk profile is based on an enterprise policy that includes custom rules for scanning of apps based on security requirements to determine whether the application includes previously known malware, exhibits new malware behaviors, poses a privacy or security risk, or any combination thereof.

6. The system recited in claim 1 , wherein the risk score is based at least in part on a reputation of a source of the application, and wherein the source of the application includes an app market.

7. The system recited in claim 1 , wherein the risk score is based at least in part on a reputation of a developer of the application.

8. The system recited in claim 1 , wherein the risk score is based at least in part on an average user rating of the application.

9. The system recited in claim 1 , wherein the risk score is based at least in part on a number of downloads of the application.

10. The system recited in claim 1 , wherein the risk score is based at least in part on whether the application is signed and includes different information than a publicly available version of the application.

11. The system recited in claim 1 , wherein the processor is further configured to:

determine a reputation associated with the application based on the vendor reputation of the application.

12. The system recited in claim 1 , wherein the processor is further configured to:

customize the risk score based on a customized risk scoring profile, wherein the customized risk scoring profile includes an enterprise-based customization.

13. The system recited in claim 1 , wherein the processor is further configured to:

determine whether the application is in violation of an enterprise policy, wherein the enterprise policy includes a malware policy for apps that includes custom rules for scanning of apps based on security requirements to determine whether the application includes previously known malware, exhibits new malware behaviors, poses a privacy or security risk, or any combination thereof.

14. The system recited in claim 1 , wherein the processor is further configured to:

generate an enterprise risk score based on an enterprise risk profile; and

perform an action based on the enterprise risk score, wherein perform the action based on the enterprise risk score includes:

report the enterprise risk score, generate an enterprise report for the application including the enterprise risk score, send a notification related to the application based on the enterprise risk score, block the application based on the enterprise risk score, or any combination thereof.

15. The system recited in claim 1 wherein the processor is further configured to:

perform a pre-screening phase that includes checking an application cache, wherein the application cache includes previously determined risk scores for previously analyzed apps that are available from a public app store.

16. The system recited in claim 1 wherein the processor is further configured to:

perform a pre-screening phase that includes checking an application cache, wherein the application cache includes previously determined risk scores for previously analyzed apps that are available from a public app store, wherein checking the application cache includes:

determine whether the application has been previously analyzed; and

in the event that the application has been previously analyzed, determine whether to return the previously determined risk score of the application.

17. The system recited in claim 1 , wherein the processor is further configured to:

perform a static analysis on the application during the automated analysis of the application based on the risk profile.

18. The system recited in claim 1 , wherein the dynamic analysis on the application is performed using an instrumented emulation environment.

19. A method of quantifying risks of applications (“apps”) for mobile devices, comprising:

receiving an application for a mobile device;

performing an automated analysis of the application based on a risk profile using a processor, wherein performing the automated analysis of the application based on the risk profile includes:

querying public application (“app”) market data relating to the application, the public app market data including an application description, an application ranking in a store, a vendor reputation of the application, or any combination thereof; and

performing a dynamic analysis on the application based on the risk profile, wherein performing the dynamic analysis includes simulating a plurality of behaviors of the application during execution on a mobile device platform;

generating a risk score based on the automated analysis of the application based on the risk profile; and

performing an action based on the risk score, wherein performing the action based on the risk score includes:

reporting the risk score, generating a report for the application including the risk score, sending a notification related to the application based on the risk score, blocking the application based on the risk score, or any combination thereof.

20. The method of claim 19 , further comprising:

extracting metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof; and

querying public app market data relating to the application based on the extracted metadata associated with the application.

21. The method of claim 19 , further comprising:

extracting metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof; and

querying public app market data relating to the application based on the extracted metadata associated with the application to determine whether the application has been repackaged with malware.

22. The method of claim 19 , further comprising:

extracting metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof, wherein extracting metadata associated with the application includes:

deobfuscating and parsing a manifest of the application to extract the metadata associated with the application; and

querying public app market data relating to the application based on the extracted metadata associated with the application.

23. The method of claim 19 , wherein the dynamic analysis on the application is performed using an instrumented emulation environment.

24. A computer program product for quantifying risks of applications (“apps”) for mobile devices, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving an application for a mobile device;

performing an automated analysis of the application based on a risk profile, wherein performing the automated analysis of the application based on the risk profile includes:

querying public application (“app”) market data relating to the application, the public app market data including an application description, an application ranking in a store, a vendor reputation of the application, or any combination thereof; and

performing a dynamic analysis on the application based on the risk profile, wherein performing the dynamic analysis includes simulating a plurality of behaviors of the application during execution on a mobile device platform;

generating a risk score based on the automated analysis of the application based on the risk profile; and

performing an action based on the risk score, wherein performing the action based on the risk score includes:

reporting the risk score, generating a report for the application including the risk score, sending a notification related to the application based on the risk score, blocking the application based on the risk score, or any combination thereof.

25. The computer program product recited in claim 24 , further comprising computer instructions for:

extracting metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof; and

querying public app market data relating to the application based on the extracted metadata associated with the application.

26. The computer program product recited in claim 24 , further comprising computer instructions for:

extracting metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof; and

querying public app market data relating to the application based on the extracted metadata associated with the application to determine whether the application has been repackaged with malware.

27. The computer program product recited in claim 24 , further comprising computer instructions for:

extracting metadata associated with the application, the metadata comprising application permissions, file and version name, author of the application, application ID, package name, or any combination thereof, wherein extracting metadata associated with the application includes:

deobfuscating and parsing a manifest of the application to extract the metadata associated with the application; and

querying public app market data relating to the application based on the extracted metadata associated with the application.

28. The computer program product recited in claim 24 , wherein the dynamic analysis on the application is performed using an instrumented emulation environment.