Symantec Corporation

Sheng Gong

Bruce McCorkendale

Jun Mao

Xue Tian

Xiaole Zhu

Qingchun Meng

Ge Hua Huang

Wei Guo Eric Hu

Sourabh Satish

Zhe Liu

Jingnan Si

Guilin Hu

Xuefeng Tian

Techniques for identifying malicious downloadable applications are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for identifying malicious downloadable applications comprising receiving a signature of a downloadable application, identifying, using at least one computer processor, a known good application having at least one attribute in common with the downloadable application and having a signature different from the signature of the downloadable application, analyzing the downloadable application to evaluate one or more risk factors based at least in part on the at least one common attribute and the difference in signatures, and determining, based on the evaluated one or more risk factors, one or more responsive actions.

Techniques for identifying malicious downloadable applications

A computer-implemented method for combining static and dynamic code analysis may include 1) identifying executable code that is to be analyzed to determine whether the executable code is capable of leaking sensitive data, 2) performing a static analysis of the executable code to identify one or more objects which the executable code may use to transfer sensitive data, the static analysis being performed by analyzing the executable code without executing the executable code, 3) using a result of the static analysis to tune a dynamic analysis to track the one or more objects identified during the static analysis, and 4) performing the dynamic analysis by, while the executable code is being executed, tracking the one or more objects identified during the static analysis to determine whether the executable code leaks sensitive data via the one or more objects. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for combining static and dynamic code analysis

A computer-implemented method for detecting malware may include 1) identifying an application configured to use a permission on a mobile computing platform, the permission enabling the application to access a feature of the mobile computing platform, 2) determining that the application is configured to use the permission while executing as a background application on the mobile computing platform, 3) determining that the use of the permission is suspect based on the application being configured to use the permission while executing as the background application, and 4) performing a remediation action in response to determining that the use of the permission is suspect. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting malware

A computer-implemented method to identify the spreading of sensitive data from a suspicious application is described. At least one security attribute for an application programming interface (API) is defined. Sensitive data passed through the at least one security attribute to the suspicious application are marked. The marked sensitive data being passed through the at least one security attribute from the suspicious application are detected. A notification is generated regarding the spreading of the sensitive data by the suspicious application.

Systems and methods for identifying the spreading of sensitive data by a suspicious application

Growing community of inventors

Beijing, China

Sheng Gong