1. A method for identifying suspicious applications comprising: determining one or more clusters of applications in an identified category of applications based on a distance metric measuring distances between requested permissions of each of two or more applications in each of the one or more clusters of applications; determining a center application of each of the one or more clusters; and determining, using at least one computer processor, a similarity score for an application being evaluated based at least in part on a distance between the application being evaluated and the center application of a closest cluster of the one or more clusters.