Evaluating Malware Mitigation by Android Market Operators

All Android markets are confronted with malicious apps, but they differ in how effective they deal with them. In this study, we evaluate the mitigation efforts of Google Play and four third-party markets. We define three metrics and measure how sensitive they are to different detection results from anti-virus vendors. Malware presence in three third-party markets – Liqucn, eoeMarket and Mumayi – is around ten times higher than in Google Play and Freeware Lovers. Searching for certain keywords in Google Play leads leads to a fifty times higher malware rate than those for popular apps. Finally, we measure malware survival times and find that Google Play seems to be the only market that effectively removes malware, though it contains a cluster of apps flagged as adware and malware over long time periods. This points to different incentives for app markets, anti-virus vendors and users.