  Previous work has investigated the particularities of security practices
within specific user communities defined based on country of origin, age, prior
tech abuse, and economic status. Their results highlight that current security
solutions that adopt a one-size-fits-all-users approach ignore the differences
and needs of particular user communities. However, those works focus on a
single community or cluster users into hard-to-interpret sub-populations.
  In this work, we perform a large-scale quantitative analysis of the risk of
encountering malware and other potentially unwanted applications (PUA) across
user communities. At the core of our study is a dataset of app installation
logs collected from 12M Android mobile devices. Leveraging user-installed apps,
we define intuitive profiles based on users' interests (e.g., gamers and
investors), and fit a subset of 5.4M devices to those profiles. Our analysis is
structured in three parts. First, we perform risk analysis on the whole
population to measure how the risk of malicious app encounters is affected by
different factors. Next, we create different profiles to investigate whether
risk differences across users may be due to their interests. Finally, we
compare a per-profile approach for classifying clean and infected devices with
the classical approach that considers the whole population.
  We observe that features such as the diversity of the app signers and the use
of alternative markets highly correlate with the risk of malicious app
encounters. We also discover that some profiles such as gamers and social-media
users are exposed to more than twice the risks experienced by the average
users. We also show that the classification outcome has a marked accuracy
improvement when using a per-profile approach to train the prediction models.
Overall, our results confirm the inadequacy of one-size-fits-all protection
solutions.
