In a previous life we used LDA (together with some other techniques) to find clusters of similar Android applications (based on their descriptions). We then loo

In a previous life we used LDA (together with some other techniques) to find clusters of similar Android applications (based on their descriptions). We then looked for apps within a cluster that used vastly different permission-gated APIs to identify malware and grayware. It worked pretty well. See http://dl.acm.org/citation.cfm?id=2568276 http://dl.acm.org/citation.cfm?id=2568276