Abstract: A mobile application development system includes a developer portal that receives an application from a developer and provides a routing library to the developer to augment the application. An offline analysis system analyzes the application to (i) determine a set of activities that a handler within the application is programmed to resume in response to respective resumption requests from a host operating system and (ii) determine parameters for each of the activities. The offline analysis system generates a set of links that each corresponds to a respective one of the activities. The routing library, installed as part of the augmented application onto a user device, receives a link, from the user device's operating system, that identifies a first activity. The routing library includes instructions for generating a first resumption request based on parameters corresponding to the first activity and transmitting the first resumption request to the augmented application's handler.

Abstract: To leverage the higher detection rate of a supplemental model and manage the higher false positive rate of that model, an activation range is tuned for the candidate model to operate in conjunction with an incumbent model. The activation range is a range of output values for the incumbent model that activates the supplemental model. Inputs having benign output values from the incumbent model that are within the activation range are fed into the supplemental model. Thus, the lower threshold of the activation range corresponds to the malware detection threshold of the incumbent model and the upper threshold determines how many benign classified outputs from the incumbent model activate the supplemental model. This conjoining of models with a tuned activation range manages overall false positive rate of the conjoined detection models while the malware detection rate increases over the incumbent detection model alone.

Abstract: A mobile application development system includes a developer portal that receives an application from a developer and provides a routing library to the developer to augment the application. An offline analysis system analyzes the application to (i) determine a set of activities that a handler within the application is programmed to resume in response to respective resumption requests from a host operating system and (ii) determine parameters for each of the activities. The offline analysis system generates a set of links that each corresponds to a respective one of the activities. The routing library, installed as part of the augmented application onto a user device, receives a link, from the user device's operating system, that identifies a first activity. The routing library includes instructions for generating a first resumption request based on parameters corresponding to the first activity and transmitting the first resumption request to the augmented application's handler.

Abstract: A mobile application development system includes a developer portal that receives an application from a developer and provides a routing library to the developer to augment the application. An offline analysis system analyzes the application to (i) determine a set of activities that a handler within the application is programmed to resume in response to respective resumption requests from a host operating system and (ii) determine parameters for each of the activities. The offline analysis system generates a set of links that each corresponds to a respective one of the activities. The routing library, installed as part of the augmented application onto a user device, receives a link, from the user device's operating system, that identifies a first activity. The routing library includes instructions for generating a first resumption request based on parameters corresponding to the first activity and transmitting the first resumption request to the augmented application's handler.

Abstract: A mobile application development system includes a developer portal that receives an application from a developer and provides a routing library to the developer to augment the application. An offline analysis system analyzes the application to (i) determine a set of activities that a handler within the application is programmed to resume in response to respective resumption requests from a host operating system and (ii) determine parameters for each of the activities. The offline analysis system generates a set of links that each corresponds to a respective one of the activities. The routing library, installed as part of the augmented application onto a user device, receives a link, from the user device's operating system, that identifies a first activity. The routing library includes instructions for generating a first resumption request based on parameters corresponding to the first activity and transmitting the first resumption request to the augmented application's handler.

Abstract: A mobile application development system includes a developer portal that receives an application from a developer and provides a routing library to the developer to augment the application. An offline analysis system analyzes the application to (i) determine a set of activities that a handler within the application is programmed to resume in response to respective resumption requests from a host operating system and (ii) determine parameters for each of the activities. The offline analysis system generates a set of links that each corresponds to a respective one of the activities. The routing library, installed as part of the augmented application onto a user device, receives a link, from the user device's operating system, that identifies a first activity. The routing library includes instructions for generating a first resumption request based on parameters corresponding to the first activity and transmitting the first resumption request to the augmented application's handler.

Abstract: A disassembler module is configured to generate machine code by performing a disassembly of a compiled iOS application. An intermediate representation generator module is configured to: from the machine code, identify an implementation of a predetermined method of providing a deep link into the iOS application; and generate intermediate representation code by formatting portions of the machine code having predetermined patterns according to predetermined instructions, respectively. A dynamic analysis module is configured to: translate the intermediate representation code into executable code; execute the executable code to identify objects for deep linking; emulate execution of the objects to identify valid ones of the objects; determine deep links for the valid ones of the objects, respectively; and store the deep links in memory.

Abstract: A search system includes a device controller that provisions a device to execute a copy of a selected mobile application. A crawler extracts content and metadata from states of the selected mobile application. A search input state classifier identifies search input states within the states based on a first set of heuristics, including recognition of user-visible search indicia and recognition of metadata that correlates with search functionality. A parameter identifier identifies, for each of the search input states, necessary input parameters. A search function data store stores a record for each identified search function. Each record includes a path to reach a corresponding search input state, an indication of required input parameters, and a mapping of the input parameters to user interface widgets. A query processing system uses the stored search functions to scrape content from the selected mobile application in response to a query.

Abstract: A search system includes a device controller that provisions a device to execute a copy of a selected mobile application. A crawler extracts content and metadata from states of the selected mobile application. A search input state classifier identifies search input states within the states based on a first set of heuristics, including recognition of user-visible search indicia and recognition of metadata that correlates with search functionality. A parameter identifier identifies, for each of the search input states, necessary input parameters. A search function data store stores a record for each identified search function. Each record includes a path to reach a corresponding search input state, an indication of required input parameters, and a mapping of the input parameters to user interface widgets. A query processing system uses the stored search functions to scrape content from the selected mobile application in response to a query.

Abstract: A mobile application development system includes a developer portal that receives a first application from a first developer and provides a routing library to the first developer for incorporation into the first application. An offline analysis system executes the first application and, during execution, monitors a sequence of user interface (UI) events initiated by an operator starting from an initial state and proceeding to a first state. The offline analysis system stores the sequence of UI events as a first data structure corresponding to the first state. The routing library includes instructions that, subsequent to installation of a copy of the first application in a user device, receive a link from an operating system of the user device identifying the first state and, based on the first data structure corresponding to the first state, replay, in order, each UI event from the sequence of UI events to the first application.

Abstract: A mobile application development system includes a developer portal that receives an application from a developer and provides a routing library to the developer to augment the application. An offline analysis system analyzes the application to (i) determine a set of activities that a handler within the application is programmed to resume in response to respective resumption requests from a host operating system and (ii) determine parameters for each of the activities. The offline analysis system generates a set of links that each corresponds to a respective one of the activities. The routing library, installed as part of the augmented application onto a user device, receives a link, from the user device's operating system, that identifies a first activity. The routing library includes instructions for generating a first resumption request based on parameters corresponding to the first activity and transmitting the first resumption request to the augmented application's handler.

Abstract: A mobile application development system includes a developer portal that receives an application from a developer and provides a routing library to the developer to augment the application. An offline analysis system analyzes the application to (i) determine a set of activities that a handler within the application is programmed to resume in response to respective resumption requests from a host operating system and (ii) determine parameters for each of the activities. The offline analysis system generates a set of links that each corresponds to a respective one of the activities. The routing library, installed as part of the augmented application onto a user device, receives a link, from the user device's operating system, that identifies a first activity. The routing library includes instructions for generating a first resumption request based on parameters corresponding to the first activity and transmitting the first resumption request to the augmented application's handler.

Abstract: A mobile application development system includes a developer portal configured to receive a copy of a first application from a first developer and provide a routing library to the first developer for incorporation into the first application before distribution. An offline analysis system uses a static analyzer to identify a set of view controllers implemented in the first application and uses a dynamic analyzer to execute the first application and, during execution, monitor messages invoking the set of view controllers and extract selector parameters used to invoke the set of view controllers. The routing library includes instructions that receive a link from an operating system and, based on a view controller name in the link, allocate memory for a view controller object indicated by the link. The instructions further initialize the view controller object based on selector parameters indicated by the link and using the allocated memory.

Abstract: A search system includes a device controller that provisions a device to execute a copy of a selected mobile application. A crawler extracts content and metadata from states of the selected mobile application. A search input state classifier identifies search input states within the states based on a first set of heuristics, including recognition of user-visible search indicia and recognition of metadata that correlates with search functionality. A parameter identifier identifies, for each of the search input states, necessary input parameters. A search function data store stores a record for each identified search function. Each record includes a path to reach a corresponding search input state, an indication of required input parameters, and a mapping of the input parameters to user interface widgets. A query processing system uses the stored search functions to scrape content from the selected mobile application in response to a query.

Abstract: A search system includes a device controller that provisions a device to execute a copy of a selected mobile application. A crawler extracts content and metadata from states of the selected mobile application. A search input state classifier identifies search input states within the states based on a first set of heuristics, including recognition of user-visible search indicia and recognition of metadata that correlates with search functionality. A parameter identifier identifies, for each of the search input states, necessary input parameters. A search function data store stores a record for each identified search function. Each record includes a path to reach a corresponding search input state, an indication of required input parameters, and a mapping of the input parameters to user interface widgets. A query processing system uses the stored search functions to scrape content from the selected mobile application in response to a query.

Abstract: A disassembler module is configured to generate ARM code by performing a disassembly of a compiled iOS application. An intermediate representation generator module is configured to: (i) from the ARM code, identify an implementation of a predetermined method of providing a deep link into the iOS application; and (ii) generate intermediate representation code by formatting portions of the ARM code having predetermined patterns according to predetermined instructions, respectively. A loader module is configured to translate the intermediate representation code into executable code including objects in a tuple format and to load the executable code for execution. An execution and emulation module is configured to: (i) execute the executable code line by line to identify NSURL objects; (ii) emulate the NSURL objects to identify valid ones of the NSURL objects; (iii) determine deep links for the valid ones, of the NSURL objects, respectively; and (iv) store the deep links in memory.

Abstract: A mobile application development system includes a developer portal configured to receive a copy of a first application from a first developer and provide a routing library to the first developer for incorporation into the first application before distribution. An offline analysis system uses a static analyzer to identify a set of view controllers implemented in the first application and uses a dynamic analyzer to execute the first application and, during execution, monitor messages invoking the set of view controllers and extract selector parameters used to invoke the set of view controllers. The routing library includes instructions that receive a link from an operating system and, based on a view controller name in the link, allocate memory for a view controller object indicated by the link. The instructions further initialize the view controller object based on selector parameters indicated by the link and using the allocated memory.

Abstract: A mobile application development system includes a developer portal that receives a first application from a first developer and provides a routing library to the first developer for incorporation into the first application. An offline analysis system executes the first application and, during execution, monitors a sequence of user interface (UI) events initiated by an operator starting from an initial state and proceeding to a first state. The offline analysis system stores the sequence of UI events as a first data structure corresponding to the first state. The routing library includes instructions that, subsequent to installation of a copy of the first application in a user device, receive a link from an operating system of the user device identifying the first state and, based on the first data structure corresponding to the first state, replay, in order, each UI event from the sequence of UI events to the first application.

Abstract: A disassembler module is configured to generate ARM code by performing a disassembly of a compiled iOS application. An intermediate representation generator module is configured to: (i) from the ARM code, identify an implementation of a predetermined method of providing a deep link into the iOS application; and (ii) generate intermediate representation code by formatting portions of the ARM code having predetermined patterns according to predetermined instructions, respectively. A loader module is configured to translate the intermediate representation code into executable code including objects in a tuple format and to load the executable code for execution. An execution and emulation module is configured to: (i) execute the executable code line by line to identify NSURL objects; (ii) emulate the NSURL objects to identify valid ones of the NSURL objects; (iii) determine deep links for the valid ones, of the NSURL objects, respectively; and (iv) store the deep links in memory.

Abstract: A mobile application development system includes a developer portal that receives an application from a developer and provides a routing library to the developer to augment the application. An offline analysis system analyzes the application to (i) determine a set of activities that a handler within the application is programmed to resume in response to respective resumption requests from a host operating system and (ii) determine parameters for each of the activities. The offline analysis system generates a set of links that each corresponds to a respective one of the activities. The routing library, installed as part of the augmented application onto a user device, receives a link, from the user device's operating system, that identifies a first activity. The routing library includes instructions for generating a first resumption request based on parameters corresponding to the first activity and transmitting the first resumption request to the augmented application's handler.