Abstract: Described herein are methods, systems, and apparatuses for query analysis and classification. A plurality of entity identifier queries associated with a plurality of entity identifiers may be received and classified as being legitimate or illegitimate. Illegitimate entity identifier queries may be associated with originating devices that are infected with malware. The originating devices may have sent the illegitimate entity identifier queries in an attempt to communicate with a command and control server(s) of a botnet. Such originating devices may be identified and one or more remedial actions may be performed.

Abstract: In one example implementation, a method includes receiving, at a computing device, a request to grant a set of requested permissions to an application installed on the computing device, and sending, from the computing device, a permission query request to a recommendation server, where the permission query request includes an identifier for the application, and the set of requested permissions. The method may also include receiving, at the computing device, from the recommendation server, a set of permission recommendations, where the set of permission recommendations indicates whether the recommendation server recommends granting each requested permission from the set of requested permissions.