  Fraudulent behaviors in Google Android app market fuel search rank abuse and
malware proliferation. We present FairPlay, a novel system that uncovers both
malware and search rank fraud apps, by picking out trails that fraudsters leave
behind. To identify suspicious apps, FairPlay PCF algorithm correlates review
activities and uniquely combines detected review relations with linguistic and
behavioral signals gleaned from longitudinal Google Play app data. We
contribute a new longitudinal app dataset to the community, which consists of
over 87K apps, 2.9M reviews, and 2.4M reviewers, collected over half a year.
FairPlay achieves over 95% accuracy in classifying gold standard datasets of
malware, fraudulent and legitimate apps. We show that 75% of the identified
malware apps engage in search rank fraud. FairPlay discovers hundreds of
fraudulent apps that currently evade Google Bouncer detection technology, and
reveals a new type of attack campaign, where users are harassed into writing
positive reviews, and install and review other apps.
