A Multi-modal Neural Embeddings Approach for Detecting Mobile Counterfeit Apps: A Case Study on Google Play Store
Naveen Karunanayake, Jathushan Rajasegaran, Ashanie Gunathillake, Suranga Seneviratne, Guillaume Jourjon · IEEE Transactions on Mobile Computing · 2020
Counterfeit apps impersonate existing popular apps in attempts to misguide users to install them for various reasons such as collecting personal information, spreading malware, or simply to increase their advertisement revenue. Many counterfeits can be identified once installed, however even a tech-savvy user may struggle to detect them before installation as app icons and descriptions can be quite similar to the original app. To this end, this paper proposes to leverage the recent advances in deep learning methods to create image and text embeddings so that counterfeit apps can be efficiently identified when they are submitted to be published in app markets. We show that for the problem of counterfeit detection, a novel approach of combiningcontent embeddingsandstyle embeddings(given by the Gram matrix of CNN feature maps) outperforms the baseline methods for image similarity such as SIFT, SURF, LATCH, and various image hashing methods. We first evaluate the performance of the proposed method on two well-known datasets for evaluating image similarity methods and show that, content, style, and combined embeddings increaseprecision@kandrecall@kby 10-15 percent and 12-25 percent, respectively when retrieving five nearest neighbours. Second specifically for the app counterfeit detection problem, combined content and style embeddings achieve 12 and 14 percent increase inprecision@kandrecall@k, respectively compared to the baseline methods. We also show that adding text embeddings further increases the performance by 5 and 6 percent in terms ofprecision@kandrecall@k, respectively when$k$is five. Third, we present an analysis of approximately 1.2 million apps from Google Play Store and identify a set of potential counterfeits for top-10,000 popular apps. Under a conservative assumption, we were able to find 2,040 potential counterfeits that contain malware in a set of 49,608 apps that showed high similarity to one of the top-10,000 popular apps in Google Play Store. We also find 1,565 potential counterfeits asking for at least five additional dangerous permissions than the original app and 1,407 potential counterfeits having at least five extra third party advertisement libraries.