Techniques for identifying suspicious applications using requested permissions

摘要

Techniques for identifying suspicious applications are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for identifying suspicious applications comprising determining one or more clusters of applications in an identified category of applications based on requested permissions of each of two or more applications in each of the one or more clusters of applications, determining a center application of each of the one or more clusters, and determining, using at least one computer processor, a similarity score for an application being evaluated based at least in part on a distance between the application being evaluated and the center application of a closest cluster of the one or more clusters.

主权项

1. A method for identifying suspicious applications comprising:
determining one or more clusters of applications in an identified category of applications based on a distance metric measuring distances between requested permissions of each of two or more applications in each of the one or more clusters of applications; determining a center application of each of the one or more clusters; and determining, using at least one computer processor, a similarity score for an application being evaluated based at least in part on a distance between the application being evaluated and the center application of a closest cluster of the one or more clusters.