In a previous life we used LDA (together with some other techniques) to find clusters of similar Android applications (based on their descriptions). We then looked for apps within a cluster that used vastly different permission-gated APIs to identify malware and grayware. It worked pretty well.