Google Inc.

Richard G Cannings

Dianne K Hackborn

Joseph M Onorato

David P Bort

Andrew T McFadden

Brian J Swetland

Daniel Reuben Bornstein

Jasper S Lin

Mark D Womack

Adrian L Ludwig

Curtis Gerald Condra

Karl Rosaen

Sebastian Johannes Porst

Devesh Parekh

Sanjay Jeyakumar

Dan Bornstein

Kenneth Root

Nicholas Neil Kralevich, Iv

Sai Deep Tetali

Mo Yu

Salvador Mandujano

Nico Falliere

Joseph Benjamin Gruver

Jonathan Bruce Larimer

Peter Valchev

A method () for identifying malicious software includes receiving and executing a software application (), identifying a plurality of uniform resource identifiers () the software application interacts with during execution of the software application, and generating a vector representation () for the software application using a feed-forward neural network () configured to receive the plurality of uniform resource identifiers as feature inputs. The method also includes determining similarity scores () for a pool of training applications, each similarity score associated with a corresponding training application and indicating a level of similarity between the vector representation for the software application and a respective vector representation for the corresponding training application. The method also includes flagging the software application as belonging to a potentially harmful application category () when one or more of the training applications have similarity scores that satisfy a similarity threshold and include a potentially harmful application label.

Identify malicious software

In one aspect, this application describes a method for determining a license status of a software application. The method includes receiving a license status request to obtain an indication of whether a software application is licensed for use on a client computing device. The method also includes identifying identity information that corresponds to user identity information, device identity information, or both. The method also includes sending a communication generated from the license status request and the identity information to a licensing service, the communication being used by the licensing service to generate the indication based at least in part on the identity information and licensing information associated with the software application. The method also includes receiving a license status response from the licensing service that includes the indication. The method also includes sending the license status response to the software application for processing by the software application.

Electronic license management

A computer-implemented method of pre-permissioning a computer application is disclosed. The method includes receiving a request from a user to install a software application, identifying one or more computing services required for operation of the software application, presenting the one or more computing services to the user for review, determining whether the user approves installation of the computer application, and installing the application on a computing device assigned to the user if the user approves installation of the computer application.

Computer application pre-permissioning

A computer-implemented method for signing computer applications is disclosed. The method includes generating a compiled version of a first software application, signing the first software application with a digital certificate locally to a developer of the first software application without assistance from a central certification authority, and submitting the signed first software application to an on-line application store.

Self-signed certificates for computer application signatures

An application distribution server may be operable to perform an application distribution process for an application, where the application distribution process may comprise a plurality of phases. The plurality of phases may comprise, in sequence, a developer account creation phase, a risk assessment phase, an application upload phase, an application publication phase, an application promotion phase and an application download phase. The application distribution server may detect, at each of the plurality of phases, whether a particular behavior corresponding to use of the application to distribute undesirable software may occur. In instances when an occurrence of the particular behavior is detected at a certain phase in the application distribution process, the application distribution server may continue, utilizing a trap system, one or more subsequent phases after the certain phase for the application, without communicating information on the detection of the occurrence of the particular behavior.

Using a honeypot workflow for software review

Systems, methods, routines and/or techniques for time delay on services (e.g., verification services) that detect undesirable content are described. In some embodiments, a flexible verification service prevents users (e.g., hackers) from using the verification service 'as an oracle' to predict whether the user's application or software program will be detected by the verification service. The verification service, after receiving a verification request from a client device, may delay or prevent the communication of a verification response to the client device. The verification service may evaluate a verification request to determine a level of risk associated with the request. The verification service may communicate an initial response to the client device that submitted the verification request. The verification service may eventually communicate the verification response to the client device, for example, after a period of delay.

Detecting undesirable content

Growing community of inventors

Santa Cruz, CA, United States of America

Richard G Cannings