Abstract: Behavioral analysis of a mobile application is performed to determine whether the application is malicious. During analysis, various user interactions are simulated in an emulated environment to activate many possible resulting behaviors of an application. The behaviors are classified as hard or soft signals. A probability of the application being malicious is determined through combining soft signals, and the application is classified as malicious or non-malicious. Users of the application, the developer of the application, or a distributor of the application are notified of the application classification to enable responsive action.

Abstract: Behavioral analysis of a mobile application is performed to determine whether the application is malicious. During analysis, various user interactions are simulated in an emulated environment to activate many possible resulting behaviors of an application. The behaviors are classified as hard or soft signals. A probability of the application being malicious is determined through combining soft signals, and the application is classified as malicious or non-malicious. Users of the application, the developer of the application, or a distributor of the application are notified of the application classification to enable responsive action.

Abstract: Behavioral analysis of a mobile application is performed to determine whether the application is malicious. During analysis, various user interactions are simulated in an emulated environment to activate many possible resulting behaviors of an application. The behaviors are classified as hard or soft signals. A probability of the application being malicious is determined through combining soft signals, and the application is classified as malicious or non-malicious. Users of the application, the developer of the application, or a distributor of the application are notified of the application classification to enable responsive action.

Abstract: Detecting a malicious advertisement is disclosed. An advertisement is analyzed. A determination that the advertisement is associated with malicious activity is made. An indication that the advertisement is malicious is provided as output. The indication can be provided as a report, such as to a publisher and can also be provided using an API, such as to the entity responsible for serving the advertisement.

Abstract: Behavioral analysis of a mobile webpage is performed to determine whether the webpage is malicious. During analysis, the webpage is visited by an emulated mobile device to cause behaviors to occur which may be malicious. The behaviors occurring after accessing the webpage are stored. The behaviors are classified as hard or soft signals. A probability of the webpage being malicious is determined through combining soft signals, and the webpage is classified as malicious or non-malicious. Users of the webpage, the developer of the webpage, or a distributor of the webpage are notified of the webpage classification to enable responsive action.

Abstract: Diversity information associated with a set of advertisement tags is determined. Example ways of determining diversity include determining a list of distinct Uniform Resource Locators, determining a list of distinct domains, and determining whether an advertisement includes one or more dynamic elements. Scans are adaptively performed based on the determined diversity information. Scanning is performed more frequently for advertisement tags having higher associated diversities and scanning is performed less frequently for advertisement tags having lower associated diversities.

Abstract: Remediating a suspicious element in a web page is disclosed. An indication of a suspicious element is received. A quarantine instruction is sent to a server of the web page. One example of a quarantine instruction is an instruction to block the page from being served. Another example of a quarantine instruction in as instruction to block an element of the page from being served.

Abstract: Detecting a suspicious element in a web page is disclosed. The page is analyzed, such as through static analysis and/or dynamic analysis techniques. A suspicious element in the page is detected. A report that includes a copy of at least a portion of the suspicious element is provided as output.

Abstract: Detecting a malicious advertisement is disclosed. An advertisement is analyzed. A determination that the advertisement is associated with malicious activity is made. An indication that the advertisement is malicious is provided as output. The indication can be provided as a report, such as to a publisher and can also be provided using an API, such as to the entity responsible for serving the advertisement.

Abstract: Performing a risk assessment of a website is disclosed. A plurality of elements included in the website is categorized. The risk posed by the presence of at least some of the plurality of elements is assessed. Example elements include third party content and out-of-date web applications. A risk assessment report is provided as output.

Abstract: Remediating a suspicious element in a web page is disclosed. An indication of a suspicious element is received. A quarantine instruction is sent to a server of the web page. One example of a quarantine instruction is an instruction to block the page from being served. Another example of a quarantine instruction in as instruction to block an element of the page from being served.

Abstract: Diversity information associated with a set of advertisement tags is determined. Example ways of determining diversity include determining a list of distinct Uniform Resource Locators, determining a list of distinct domains, and determining whether an advertisement includes one or more dynamic elements. Scans are adaptively performed based on the determined diversity information. Scanning is performed more frequently for advertisement tags having higher associated diversities and scanning is performed less frequently for advertisement tags having lower associated diversities.

Abstract: Detecting a malicious advertisement is disclosed. An advertisement is analyzed. A determination that the advertisement is associated with malicious activity is made. An indication that the advertisement is malicious is provided as output. The indication can be provided as a report, such as to a publisher and can also be provided using an API, such as to the entity responsible for serving the advertisement.

Abstract: Remediating a suspicious element in a web page is disclosed. An indication of a suspicious element is received. A quarantine instruction is sent to a server of the web page. One example of a quarantine instruction is an instruction to block the page from being served. Another example of a quarantine instruction in as instruction to block an element of the page from being served.

Abstract: Embodiments of the present invention provide users with apparatus and methods for managing user data and for making and accepting payments. A system for enabling secure payment transactions comprises user hardware, recipient hardware, and a data system, in accordance with an embodiment of the present invention. The data system comprises a database and a database manager. The database includes storage means adapted to store user data. The database manager is adapted for controlling and managing access to the data in the database. The database manager is adapted for communication with the user hardware, recipient hardware, and the payment processing space, including financial institutions and other suppliers of data.