FairPlay: Fraud and Malware Detection in Google Play
This addresses fraud and malware proliferation in app markets, which impacts users and developers, though it is incremental as it builds on existing detection methods.
The paper tackles the problem of fraud and malware detection in the Google Play app market by developing FairPlay, a system that identifies suspicious apps with over 95% accuracy and reveals that 75% of identified malware apps engage in search rank fraud.
Fraudulent behaviors in Google Android app market fuel search rank abuse and malware proliferation. We present FairPlay, a novel system that uncovers both malware and search rank fraud apps, by picking out trails that fraudsters leave behind. To identify suspicious apps, FairPlay PCF algorithm correlates review activities and uniquely combines detected review relations with linguistic and behavioral signals gleaned from longitudinal Google Play app data. We contribute a new longitudinal app dataset to the community, which consists of over 87K apps, 2.9M reviews, and 2.4M reviewers, collected over half a year. FairPlay achieves over 95% accuracy in classifying gold standard datasets of malware, fraudulent and legitimate apps. We show that 75% of the identified malware apps engage in search rank fraud. FairPlay discovers hundreds of fraudulent apps that currently evade Google Bouncer detection technology, and reveals a new type of attack campaign, where users are harassed into writing positive reviews, and install and review other apps.