Detecting malware on mobile devices

摘要

In one example, a mobile device includes a network interface configured to receive data for an application including a set of application permissions describing elements of the mobile device to which the application will have access upon installation of the application, and a processing unit configured to determine a type for the application and, based on an analysis of the set of application permissions and the type for the application, determine whether the application includes malware.

主权项

1. A method comprising:
receiving, by a mobile device, data for an application including a set of application permissions describing elements of the mobile device to which the application will have access upon installation of the application; determining, by the mobile device, a type for the application, wherein the type for the application corresponds to a set of expected elements of the mobile device to which applications of that type have access upon installation; and based on a comparison of the set of application permissions for the application and the set of expected elements of the mobile device to which the type for the application corresponds, determining, by the mobile device, whether the application includes malware.