Methods, systems, articles of manufacture and apparatus to verify application permission safety

Patent metadata

Field	Value
Publication number	US-10990679-B2
Application number	US-201815972803-A
Country	US
Kind code	B2
Filing date	May 7, 2018
Priority date	May 7, 2018
Publication date	Apr 27, 2021
Grant date	Apr 27, 2021

Abstract

Methods, apparatus, systems and articles of manufacture are disclosed to verify application permission safety. An example apparatus to identify unsafe permissions associated with a candidate app disclosed herein includes an app classifier interface to retrieve a cluster of apps associated with the candidate app, the candidate app including a requested permission set (RPS), a trusted app (TA) identifier to identify a set of TAs within the cluster, the set of TAs associated with a designation of trust, a safe permission set (SPS) evaluator to generate an SPS list associated with the set of TAs within the cluster, and an RPS identifier to determine whether permissions of the RPS are listed in the SPS list, the SPS evaluator further to designate first respective ones of the permissions of the RPS as safe when the first respective ones of the permissions are listed in the SPS list, and designate second respective ones of the permissions of the RPS as unsafe when the second respective ones of the permissions are absent from the SPS list.

First claim

What is claimed is:

1. An apparatus to identify unsafe permissions associated with a candidate app, the apparatus comprising:
at least one hardware processor;
an app classifier interface to retrieve a cluster of apps, the cluster of apps indicative of a first quantity, associated with the candidate app, the candidate app including a requested permission set (RPS);
a trusted app (TA) identifier to identify a set of TAs within the cluster, the set of TAs associated with a designation of trust;
a safe permission set (SPS) evaluator to generate an SPS list associated with the set of TAs within the cluster;
an RPS identifier to determine whether permissions of the RPS are listed in the SPS list, the SPS evaluator further to:
designate first respective ones of the permissions of the RPS as safe when the first respective ones of the permissions are listed in the SPS list; and
designate second respective ones of the permissions of the RPS as unsafe when the second respective ones of the permissions are absent from the SPS list; and

an anomaly score determiner to:
determine a deviation index for one of the second respective ones of the permissions of the RPS; and
identify a second quantity of the apps within the cluster of apps that do not include the one of the second respective ones of the permissions, at least one of the app classifier, the TA identifier, the SPS evaluation, the RPS identifier, or the anomaly score determiner implemented by the at least one hardware processor.

2. The apparatus as defined in claim 1 , wherein the anomaly score determiner is to determine the deviation index based on a ratio of the second quantity and the first quantity.

3. The apparatus as defined in claim 1 , further including a threshold evaluator to determine if the deviation index satisfies a deviation index threshold.

4. The apparatus as defined in claim 3 , further including a client device installation controller to:
generate a prohibition directive when the deviation index satisfies the deviation index threshold; and
generate a discretionary directive when the deviation index does not satisfy the deviation index threshold.

5. The apparatus as defined in claim 4 , wherein the prohibition directive is to cause a client device to deny the one of the second respective ones of the permissions of the RPS associated with the candidate app.

6. The apparatus as defined in claim 4 , wherein the discretionary directive is to cause a client device to permit a selection of at least one of allowing or denying the one of the second respective ones of the permissions of the RPS associated with the candidate app.

7. The apparatus as defined in claim 4 , further including a client interface to transmit the prohibition directive or the discretionary directive to a client device.

8. A method to identify unsafe permissions associated with a candidate app, the method comprising:
retrieving, by executing instructions with a processor, a cluster of apps associated with the candidate app, the cluster of apps indicative of a first quantity, the candidate app including a requested permission set (RPS);
identifying, by executing instructions with the processor, a set of trusted apps (TAs) within the cluster, the set of TAs associated with a designation of trust;
generating, by executing instructions with the processor, a safe permission set (SPS) list associated with the set of TAs within the cluster;
determining, by executing instructions with the processor, whether permissions of the RPS are listed in the SPS list;
designating, by executing instructions with the processor, first respective ones of the permissions of the RPS as safe when the first respective ones of the permissions are listed in the SPS list;
designating, by executing instructions with the processor, second respective ones of the permissions of the RPS as unsafe when the second respective ones of the permissions are absent from the SPS list;
determining a deviation index for one of the second respective ones of the permissions of the RPS; and
identifying a second quantity of the apps within the cluster of apps that do not include the one of the second respective ones of the permissions.

9. The method as defined in claim 8 , further including determining the deviation index based on a ratio of the second quantity and the first quantity.

10. The method as defined in claim 8 , further including determining if the deviation index satisfies a deviation index threshold.

11. The method as defined in claim 10 , further including:
generating a prohibition directive when the deviation index satisfies the deviation index threshold; and
generating a discretionary directive when the deviation index does not satisfy the deviation index threshold.

12. At least one non-transitory computer readable storage media comprising computer readable instructions that, when executed, cause one or more processors to, at least:
retrieve a cluster of apps associated with the candidate app, the cluster of apps indicative of a first quantity, the candidate app including a requested permission set (RPS);
identify a set of trusted apps (TAs) within the cluster, the set of TAs associated with a designation of trust;
generate a safe permission set (SPS) list associated with the set of TAs within the cluster;
determine whether permissions of the RPS are listed in the SPS list;
designate first respective ones of the permissions of the RPS as safe when the first respective ones of the permissions are listed in the SPS list;
designate second respective ones of the permissions of the RPS as unsafe when the second respective ones of the permissions are absent from the SPS list;
determine a deviation index for one of the second respective ones of the permissions of the RPS; and
identify a second quantity of the apps within the cluster of apps that do not include the one of the second respective ones of the permissions.

13. The at least one storage media as defined in claim 12 , wherein the computer readable instructions, when executed, cause the one or more processors to determine the deviation index based on a ratio of the second quantity and the first quantity.

14. The at least one storage media as defined in claim 12 , wherein the computer readable instructions, when executed, cause the one or more processors to determine if the deviation index satisfies a deviation index threshold.

Assignees

• Mcafee Llc

Inventors

• Kulkarni Dattatraya
• Srivastava Himanshu
• Vardhan Raj
• Sinha Raja
• Nalluri Srikanth
• Konda Tirumaleswar Reddy

Classifications

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• H04W12/37

  Managing security policies for mobile devices or for controlling mobile applications · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/629 Primary

  to features or functions of an application · CPC title

• G06F21/51

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title