A method for detecting malicious software is described. In one embodiment, the method includes identifying an unknown application on mobile device, identifying a package name of the unknown application, analyzing the package name of the unknown application in relation to package names of one or more categorized applications, and determining a likelihood the unknown application includes malware based at least in part on analyzing the package name of the unknown application.