ReckDroid: Detecting red packet fraud in Android apps

Recently, red packets have appeared widely in various mobile apps. Related security issues like fraud are gradually coming into the public eye. As a new means of fraud, red packet fraud has not yet been explored or addressed. In this paper, based on our empirical study on red packets, we propose a novel approach ReckDroid for red packet fraud detection. Our approach adopts a heuristic algorithm to identify red packets and then detects red packet fraud by analyzing the network traffic dynamically generated during the automated exploration of mobile apps. Our experiments are performed on hundreds of labeled real-world apps. Experimental results show that ReckDroid identifies red packets with a precision of 98.0% and a recall of 93.3%, and detects red packet fraud with a precision of 88.6% and a recall of 92.5%. By applying ReckDroid to over 1000 Android apps in the wild, we find that apps with red packets account for 17.6% of apps from seven app markets (including Google Play) while red packet fraud mainly occurs in Chinese app markets.