A method including collecting, by a communication device comprising a machine learning model obtained at least in part from a server computer, metadata associated with an application. The communication device can then embed the metadata to form vectorized data. The communication device can input the vectorized data into the machine learning model to obtain a security value. The communication device can determine whether to run or install the application based upon the security value.