Abstract:
Applications running on a mobile device are monitored for suspicious actions utilizing mobile features of the mobile device. Once a suspicious action performed by an application is detected, that suspicious action is suspended. Information about the suspicious action and the application is collected and transmitted to a remote security system over a wireless network. The security system analyzes the suspicious action and the application to determine a security rating of the application, and transmit the security rating back to the mobile device. Whether the application is malware and whether the suspicious action should be allowed to continue are both determined based on the security rating.