A Neural Embeddings Approach for Detecting Mobile Counterfeit Apps

TL;DR

This paper introduces a neural embedding method using style and content features from CNNs to detect counterfeit mobile apps, significantly improving identification accuracy over traditional techniques.

Contribution

It presents a novel style embedding approach using Gram matrices from CNN filters for counterfeit app detection, outperforming existing methods.

Findings

Style embeddings outperform content embeddings and SIFT features.

Combining style and content embeddings enhances detection performance.

Identified 139 malware-containing apps among visually similar counterfeit set.

Abstract

Counterfeit apps impersonate existing popular apps in attempts to misguide users to install them for various reasons such as collecting personal information, spreading malware, or simply to increase their advertisement revenue. Many counterfeits can be identified once installed, however even a tech-savvy user may struggle to detect them before installation as app icons and descriptions can be quite similar to the original app. To this end, this paper proposes to use neural embeddings generated by state-of-the-art convolutional neural networks (CNNs) to measure the similarity between images. Our results show that for the problem of counterfeit detection a novel approach of using style embeddings given by the Gram matrix of CNN filter responses outperforms baseline methods such as content embeddings and SIFT features. We show that further performance increases can be achieved by combining style embeddings with content embeddings. We present an analysis of approximately 1.2 million apps from Google Play Store and identify a set of potential counterfeits for top-1,000 apps. Under a conservative assumption, we were able to find 139 apps that contain malware in a set of 6,880 apps that showed high visual similarity to one of the top-1,000 apps in Google Play Store.