Identifying Malware Fraud Detection in Web Application using Content Integrity Verification

Abstract

Fraudulent behaviors in Google Play,the most popular Android app market,fuel search rank abuse and malware proliferation. To identify malware, previous work has focused on app executable and permission analysis.In this paper,we introduce Fair Play,anovel system that discovers and leverages traces left behind by fraudsters, to detect both malware and apps subjected to search rank fraud. Fair Play correlate sreview activities and uniquely combines detected review relations with linguisticand behavioral signals gleaned from GooglePlay appdata(87Kapps,2.9Mreviews,and2.4Mreviewers, collected over half a year),in order to identify suspicious apps. Fair Play achieves over 95% accuracy in classifying gold standard datasets of malware, fraudulent and legitimate apps. We show that 75% of the identified malware apps engagein searchrankfraud.Fair Play discovers hundreds off raudulent apps that currently evadeGoogleBouncer’s detection technology. FairPlay also helped the discovery of more than 1,000 reviews,reported for 193 apps that reveala new type of“ coercive” review campaign: users areharassed into writing positive reviews,and install and review other apps. Indexterms:Android market, search rank fraud, malwaredetection