Mobile device application interaction reputation risk assessment

Patent metadata

Field	Value
Publication number	US-9298928-B2
Application number	US-201414477055-A
Country	US
Kind code	B2
Filing date	Sep 4, 2014
Priority date	Oct 14, 2013
Publication date	Mar 29, 2016
Grant date	Mar 29, 2016

Abstract

A computer processor receives rules associated with applications installed on a mobile device, and collects declared intents of the applications prior to execution of the applications. The computer processor generates possible combinations of declared intents of the applications and collects, by an intent proxy during execution, information associated with intercepted intents. The computer processor compares the information associated with each of the intercepted intents to the rules, wherein a match results in a first violation. The computer processor compares the intercepted intents to the possible combinations of the declared intents, wherein the intercepted intents other than the possible combinations of the declared intents results in a second violation. The computer processor displays a risk alert for the applications associated with either or both of the first violation and the second violation.

First claim

What is claimed is:

1. A method for determining a risk of a mobile application, the method comprising:
receiving rules associated with applications installed on a mobile device, wherein each rule defines one or more actions that, if detected, generates an alert;
collecting declared intents of the applications installed on the mobile device prior to execution of the applications;
generating possible combinations of the declared intents collected from the applications installed on the mobile device;
collecting, by an intent proxy during execution of each of the applications installed on the mobile device, information associated with intercepted intents, wherein the information collected by the intent proxy includes a component of the mobile device to which an intent is directed, and an action to be performed by the intent;
comparing the information associated with each of the intercepted intents to the received rules, wherein a match between the information of one or a combination of the intercepted intents and one or more of the received rules, results in a first violation;
comparing the intercepted intents to the possible combinations of the declared intents, wherein either an intercepted intent that is not a declared intent, or a combination of the compared intercepted intents that is not one of the possible combinations of the declared intents, results in a second violation; and
responsive to the result of either or both of the first violation and the second violation, displaying, on the mobile device, a risk alert for one or more of the applications installed on the mobile device that are associated with either or both of the first violation and the second violation.

2. The method of claim 1 , wherein comparing the information associated with each of the intercepted intents to the rules, comprises:
analyzing the rules by use of text analytics to determine a string syntax for each of the rules; and
analyzing the information associated with the intercepted intents by use of text analytics, wherein the information includes an action description for each of the intercepted intents, to determine a string syntax for each action description.

3. The method of claim 1 , wherein each of the rules and each of the declared intents and intercepted intents, includes one or a combination of: keywords, key phrases, acronyms, numerals, symbols, and characters.

4. The method of claim 1 , further comprising:
determining a risk alert index value, wherein the risk alert index value is based inversely on a number of the intercepted intents that combine to complete an activity that violates one or more of the rules, whereby a larger number of the intercepted intents that combine to complete the activity that violates one or more of the rules results in a lower risk for the risk alert index value.

5. The method of claim 1 , wherein generating possible combinations includes generating a connection level, based on a number of connections between applications that results in a completed activity or operation.

6. The method of claim 1 , wherein displaying the risk alert for the applications associated with either or both of the first violation and the second violation, comprises:
displaying a risk alert index value, an identity of the applications associated with the risk alert index value, and the information associated with the intercepted intents of the applications on the mobile device associated with the risk alert index value.

7. The method of claim 1 , wherein displaying the risk alert includes one or a combination of: displaying a visual alert, producing an audible alert, producing a vibrating alert, displaying a list of options to a user of the mobile device to mitigate the risk alert.

Assignees

• Globalfoundries Inc

Inventors

• Borghetti Stefano
• Donatelli Alessandro
• Della Corte Gianluca
• Marinelli Claudio
• Sgro' Antonio M

Classifications

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title