1. A method comprising: receiving, by a data processing apparatus, at least one application associated with an associated developer account that submitted the at least one application to an application ecosystem; extracting, by the data processing apparatus, at least one signal for the at least one application from at least one of the at least one application or the associated developer account, wherein each signal from the at least one signal comprises an indicator that provides information relating to a particular aspect of either the respective application or the respective associated developer account; determining, by the data processing apparatus, a banned prevalence percentage for the at least one signal, the banned prevalence percentage indicating either a number of banned developer accounts that include the at least one signal relative to a total number of developer accounts in the application ecosystem or a number of banned applications that include the at least one signal relative to a total number of applications in the application ecosystem; comparing, by the data processing apparatus, the banned prevalence percentage to a banned prevalence percentage threshold for the at least one signal; generating, by the data processing apparatus, at least one signal rule for the at least one signal based on the comparison of the banned prevalence percentage to the banned prevalence percentage threshold for the at least one signal; and storing the at least one signal rule.