Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3366423.3380242acmconferencesArticle/Chapter ViewAbstractPublication PagesthewebconfConference Proceedingsconference-collections
research-article

MadDroid: Characterizing and Detecting Devious Ad Contents for Android Apps

Published: 20 April 2020 Publication History

Abstract

Advertisement drives the economy of the mobile app ecosystem. As a key component in the mobile ad business model, mobile ad content has been overlooked by the research community, which poses a number of threats, e.g., propagating malware and undesirable contents. To understand the practice of these devious ad behaviors, we perform a large-scale study on the app contents harvested through automated app testing. In this work, we first provide a comprehensive categorization of devious ad contents, including five kinds of behaviors belonging to two categories: ad loading content and ad clicking content. Then, we propose MadDroid, a framework for automated detection of devious ad contents. MadDroid leverages an automated app testing framework with a sophisticated ad view exploration strategy for effectively collecting ad-related network traffic and subsequently extracting ad contents. We then integrate dedicated approaches into the framework to identify devious ad contents. We have applied MadDroid to 40,000 Android apps and found that roughly 6% of apps deliver devious ad contents, e.g., distributing malicious apps that cannot be downloaded via traditional app markets. Experiment results indicate that devious ad contents are prevalent, suggesting that our community should invest more effort into the detection and mitigation of devious ads towards building a trustworthy mobile advertising ecosystem.

References

[1]
2016. Xposed Framework API. https://api.xposed.info/reference/packages.html.
[2]
2017. Google Play Store malware targets porn ads at millions of kids. http://www.itpro.co.uk/malware/30294/google-play-store-malware-targets-porn-ads-at-millions-of-kids.
[3]
2017. Malware Displaying Porn Ads Discovered in Game Apps on Google Play. https://research.checkpoint.com/malware-displaying-porn-ads-discovered-in-game-apps-on-google-play/.
[4]
2018. Ad contents contain malicious coinminer scripts. http://bbs.360.cn/thread-15338398-1-1.html.
[5]
2018. Detection Result. https://www.virustotal.com/#/file/89225036f339ac101180699d85eef790e3017f1d0773d6e4a69e680a2bd27060/detection.
[6]
2018. Developer Policy Center: Monetization and Ads. https://play.google.com/about/monetization-ads/.
[7]
2018. Open nsfw model. https://github.com/yahoo/open_nsfw
[8]
2018. Optical character recognition - Wikipedia. https://en.wikipedia.org/wiki/Optical_character_recognition.
[9]
2018. The PASCAL Visual Object Classes Homepage. host.robots.ox.ac.uk/pascal/VOC/.
[10]
2018. Speeded up robust features. https://en.wikipedia.org/wiki/Speeded_up_robust_features.
[11]
2018. VirusTotal. https://www.virustotal.com/.
[12]
2018. YOLO: Real-Time Object Detection. https://pjreddie.com/darknet/yolo/.
[13]
2019. Magic Candy - Google Play. https://play.google.com/store/apps/details?id=com.gamoper.magiccandy.free.
[14]
AppBrain. 2018. Current number of Android apps on Google Play. https://www.appbrain.com/stats.
[15]
Michael Backes, Sven Bugiel, and Erik Derr. 2016. Reliable third-party library detection in android and its security applications. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 356–367.
[16]
Gong Chen, Wei Meng, and John Copeland. 2019. Revisiting Mobile Advertising Threats with MAdLife. In The World Wide Web Conference. ACM, 207–217.
[17]
Kai Chen, Xueqiang Wang, Yi Chen, Peng Wang, Yeonjoon Lee, XiaoFeng Wang, Bin Ma, Aohui Wang, Yingjun Zhang, and Wei Zou. 2016. Following devil’s footprints: Cross-platform analysis of potentially harmful libraries on android and ios. In Security and Privacy (SP), 2016 IEEE Symposium on. IEEE, 357–376.
[18]
Shih-Hsin Chen and Yi-Hui Chen. 2017. A content-based image retrieval method based on the google cloud vision api and wordnet. In Asian conference on intelligent information and database systems. Springer, 651–662.
[19]
Geumhwan Cho, Junsung Cho, Youngbae Song, and Hyoungshick Kim. 2015. An empirical study of click fraud in mobile advertising networks. In 2015 10th International Conference on Availability, Reliability and Security. IEEE, 382–388.
[20]
Marco Cova, Christopher Kruegel, and Giovanni Vigna. 2010. Detection and analysis of drive-by-download attacks and malicious JavaScript code. In Proceedings of the 19th international conference on World wide web. 281–290.
[21]
Jonathan Crussell, Ryan Stevens, and Hao Chen. 2014. Madfraud: Investigating ad fraud in android applications. In Proceedings of the 12th annual international conference on Mobile systems, applications, and services. ACM, 123–134.
[22]
Daoyoudao. 2019. Daoyoudao-Mobile Advertising. http://www.daoyoudao.com/dsp.
[23]
Erik Derr, Sven Bugiel, Sascha Fahl, Yasemin Acar, and Michael Backes. 2017. Keep me updated: An empirical study of third-party library updatability on Android. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 2187–2200.
[24]
Shivang Desai. 2017. Malicious Android Ads leading to drive by downloads. https://www.zscaler.com/blogs/research/malicious-android-ads-leading-drive-downloads.
[25]
Android Developers. 2017. Monkeyrunner. https://developer.android.com/studio/test/monkeyrunner/index.html.
[26]
DIGIDAY. 2017. The state of mobile advertising. https://digiday.com/marketing/state-mobile-advertising/.
[27]
Samuel Dodge, Jiu Xu, and Björn Stenger. 2017. Parsing floor plan images. In 2017 Fifteenth IAPR International Conference on Machine Vision Applications (MVA). IEEE, 358–361.
[28]
Feng Dong, Haoyu Wang, Li Li, Yao Guo, Tegawendé F Bissyandé, Tianming Liu, Guoai Xu, and Jacques Klein. 2018. FraudDroid: Automated Ad Fraud Detection for Android Apps. In The 26th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE 2018).
[29]
Feng Dong, Haoyu Wang, Li Li, Yao Guo, Guoai Xu, and Shaodong Zhang. 2018. How do mobile apps violate the behavioral policy of advertisement libraries?. In Proceedings of the 19th International Workshop on Mobile Computing Systems & Applications. 75–80.
[30]
MARIA GERSEN. 2016. MOBILE AD FRAUD: DEFINITION, TYPES, DETECTION. https://clickky.biz/blog/2016/12/mobile-ad-fraud-definition-types-detection/
[31]
Google. 2019. Healthcare and medicines - Advertising Policies Help. https://support.google.com/adspolicy/answer/176031.
[32]
Google. 2019. Vision AI | Derive Image Insights via ML | Cloud Vision API | Google Cloud. https://cloud.google.com/vision/#industry-leading-accuracy-for-image-understanding.
[33]
Michael C Grace, Wu Zhou, Xuxian Jiang, and Ahmad-Reza Sadeghi. 2012. Unsafe exposure analysis of mobile in-app advertisements. In Proceedings of the fifth ACM conference on Security and Privacy in Wireless and Mobile Networks. ACM, 101–112.
[34]
MARSHALL HONOROF. 2017. Malicious Web Ad Infecting Android Phones. https://www.tomsguide.com/us/malvertising-lock-android-phones, news-25255.html.
[35]
Yangyu Hu, Haoyu Wang, Li Li, Yao Guo, Guoai Xu, and Ren He. 2019. Want to earn a few extra bucks? a first look at money-making apps. In 2019 IEEE 26th International Conference on Software Analysis, Evolution and Reengineering (SANER). IEEE, 332–343.
[36]
Yangyu Hu, Haoyu Wang, Yajin Zhou, Yao Guo, Li Li, Bingxuan Luo, and Fangren Xu. 2019. Dating with scambots: Understanding the ecosystem of fraudulent dating applications. IEEE Transactions on Dependable and Secure Computing (2019).
[37]
Pingfan Kong, Li Li, Jun Gao, Kui Liu, Tegawendé F Bissyandé, and Jacques Klein. 2018. Automated Testing of Android Apps: A Systematic Literature Review. IEEE Transactions on Reliability(2018).
[38]
Selena Larson. 2017. Spammy Ads That Hijack Your Smartphone Are Now A Virtual Plague. https://readwrite.com/2014/05/15/app-redirects-mobile-spam-ads/.
[39]
Eric Lawrence. 2013. Understanding FiddlerScript. https://www.telerik.com/blogs/understanding-fiddlerscript.
[40]
Li Li, Alexandre Bartel, Tegawendé F Bissyandé, Jacques Klein, Yves Le Traon, Steven Arzt, Siegfried Rasthofer, Eric Bodden, Damien Octeau, and Patrick Mcdaniel. 2015. IccTA: Detecting Inter-Component Privacy Leaks in Android Apps. In Proceedings of the 37th International Conference on Software Engineering (ICSE 2015).
[41]
Li Li, Tegawendé F Bissyandé, Jacques Klein, and Yves Le Traon. 2016. An Investigation into the Use of Common Libraries in Android Apps. In The 23rd IEEE International Conference on Software Analysis, Evolution, and Reengineering (SANER 2016).
[42]
Li Li, Tegawendé F Bissyandé, Mike Papadakis, Siegfried Rasthofer, Alexandre Bartel, Damien Octeau, Jacques Klein, and Yves Le Traon. 2017. Static Analysis of Android Apps: A Systematic Literature Review. Information and Software Technology(2017).
[43]
Li Li, Jun Gao, Médéric Hurier, Pingfan Kong, Tegawendé F Bissyandé, Alexandre Bartel, Jacques Klein, and Yves Le Traon. 2017. AndroZoo++: Collecting Millions of Android Apps and Their Metadata for the Research Community. arXiv preprint arXiv:1709.05281(2017).
[44]
Li Li, Daoyuan Li, Tegawendé F Bissyandé, Jacques Klein, Yves Le Traon, David Lo, and Lorenzo Cavallaro. 2017. Understanding Android App Piggybacking: A Systematic Study of Malicious Code Grafting. IEEE Transactions on Information Forensics & Security (TIFS) (2017).
[45]
Li Li, Timothée Riom, Tegawendé F Bissyandé, Haoyu Wang, Jacques Klein, 2019. Revisiting the impact of common libraries for android-related investigations. Journal of Systems and Software 154 (2019), 157–175.
[46]
Menghao Li, Wei Wang, Pei Wang, Shuai Wang, Dinghao Wu, Jian Liu, Rui Xue, and Wei Huo. 2017. LibD: scalable and precise third-party library detection in android markets. In Software Engineering (ICSE), 2017 IEEE/ACM 39th International Conference on. IEEE, 335–346.
[47]
Yuanchun Li, Ziyue Yang, Yao Guo, and Xiangqun Chen. 2017. Droidbot: a lightweight ui-guided test input generator for android. In Software Engineering Companion (ICSE-C), 2017 IEEE/ACM 39th International Conference on. IEEE, 23–26.
[48]
Zhou Li, Kehuan Zhang, Yinglian Xie, Fang Yu, and XiaoFeng Wang. 2012. Knowing your enemy: understanding and detecting malicious web advertising. In Proceedings of the 2012 ACM conference on Computer and communications security. 674–686.
[49]
Yu-Chun Lin, Hung-Wei Tseng, and Chiou-Shann Fuh. 2003. Pornography detection using support vector machine. In 16th IPPR Conference on Computer Vision, Graphics and Image Processing (CVGIP 2003), Vol. 19. 123–130.
[50]
Bin Liu, Suman Nath, Ramesh Govindan, and Jie Liu. 2014. DECAF: Detecting and Characterizing Ad Fraud in Mobile Apps. In NSDI. 57–70.
[51]
Minxing Liu, Haoyu Wang, Yao Guo, and Jason Hong. 2016. Identifying and analyzing the privacy of apps for kids. In Proceedings of the 17th International Workshop on Mobile Computing Systems and Applications. 105–110.
[52]
Tianming Liu, Haoyu Wang, Li Li, Guangdong Bai, Yao Guo, and Guoai Xu. 2019. DaPanda: Detecting Aggressive Push Notifications in Android Apps. In 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 66–78.
[53]
Long Lu, Vinod Yegneswaran, Phillip Porras, and Wenke Lee. 2010. Blade: an attack-agnostic approach for preventing drive-by malware infections. In Proceedings of the 17th ACM conference on Computer and communications security. 440–450.
[54]
Ziang Ma, Haoyu Wang, Yao Guo, and Xiangqun Chen. 2016. LibRadar: fast and accurate detection of third-party libraries in Android apps. In Proceedings of the 38th international conference on software engineering companion. ACM, 653–656.
[55]
Jorge A Marcial-Basilio, Gualberto Aguilar-Torres, Gabriel Sánchez-Pérez, L Karina Toscano-Medina, and Hector M Perez-Meana. 2011. Detection of pornographic digital images. International journal of computers 5, 2 (2011), 298–305.
[56]
Huawei Market. 2018. Huawei Market App Developer Policy. http://developer.huawei.com/consumer/cn/devservice/develop/mobile.
[57]
Tencent Myapp Market. 2018. Tencent Myapp Market App Developer Policy. http://open.qq.com/.
[58]
Masoud Mazloom, Robert Rietveld, Stevan Rudinac, Marcel Worring, and Willemijn Van Dolen. 2016. Multimodal popularity prediction of brand-related social media posts. In Proceedings of the 24th ACM international conference on Multimedia. ACM, 197–201.
[59]
Hesham Mekky, Ruben Torres, Zhi-Li Zhang, Sabyasachi Saha, and Antonio Nucci. 2014. Detecting malicious http redirections using trees of user browsing activity. In IEEE INFOCOM 2014-IEEE Conference on Computer Communications. IEEE, 1159–1167.
[60]
Mondovo. 2019. The Most Searched Casino Keywords in Google | Mondovo. https://www.mondovo.com/keywords/casino-keywords.
[61]
Suman Nath. 2015. Madscope: Characterizing mobile in-app targeted ads. In Proceedings of the 13th Annual International Conference on Mobile Systems, Applications, and Services. ACM, 59–73.
[62]
Paul Pearce, Adrienne Porter Felt, Gabriel Nunez, and David Wagner. 2012. Addroid: Privilege separation for applications and advertisers in android. In Proceedings of the 7th ACM Symposium on Information, Computer and Communications Security. Acm, 71–72.
[63]
Vaibhav Rastogi, Rui Shao, Yan Chen, Xiang Pan, Shihong Zou, and Ryan Riley. 2016. Are these Ads Safe: Detecting Hidden Attacks through the Mobile App-Web Interfaces. In NDSS.
[64]
Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. 2016. You only look once: Unified, real-time object detection. In Proceedings of the IEEE conference on computer vision and pattern recognition. 779–788.
[65]
Joseph Redmon and Ali Farhadi. 2018. Yolov3: An incremental improvement. arXiv preprint arXiv:1804.02767(2018).
[66]
Rui Shao, Vaibhav Rastogi, Yan Chen, Xiang Pan, Guanyu Guo, Shihong Zou, and Ryan Riley. 2018. Understanding In-App Ads and Detecting Hidden Attacks through the Mobile App-Web Interface. IEEE Transactions on Mobile Computing 17, 11 (2018), 2675–2688.
[67]
Sooel Son, Daehyeok Kim, and Vitaly Shmatikov. 2016. What Mobile Ads Know About Mobile Users. In NDSS.
[68]
Gianluca Stringhini, Christopher Kruegel, and Giovanni Vigna. 2013. Shady paths: Leveraging surfing crowds to detect malicious web pages. In Proceedings of the 2013 ACM SIGSAC conference on Computer & Communications Security. 133–144.
[69]
Guillermo Suarez-Tangil and Gianluca Stringhini. 2018. Eight Years of Rider Measurement in the Android Malware Ecosystem: Evolution and Lessons Learned. arXiv preprint arXiv:1801.08115(2018).
[70]
Telerik. 2019. Fiddler - Free Web Debugging Proxy - Telerik. https://www.telerik.com/fiddler.
[71]
Adrian Ulges and Armin Stahl. 2011. Automatic detection of child pornography using color visual words. In Multimedia and Expo (ICME), 2011 IEEE International Conference on. IEEE, 1–6.
[72]
Timothy Vidas and Nicolas Christin. 2014. Evading android runtime analysis via sandbox detection. In Proceedings of the 9th ACM symposium on Information, computer and communications security. ACM, 447–458.
[73]
Eliana Vuijsje. 2016. Malvertising: A Profound Threat to Mobile Advertising. https://www.blog.geoedge.com/single-post/2016/05/10/Malvertising-A-Profound-Threat-to-Mobile-Advertising.
[74]
Wandoujia. 2018. Wandoujia (Ali App) Developer Policy. http://aliapp.open.uc.cn/wiki/?p=140.
[75]
Haoyu Wang and Yao Guo. 2017. Understanding third-party libraries in mobile app analysis. In 2017 IEEE/ACM 39th International Conference on Software Engineering Companion (ICSE-C). IEEE, 515–516.
[76]
Haoyu Wang, Yao Guo, Ziang Ma, and Xiangqun Chen. 2015. Wukong: A scalable and accurate two-phase approach to android app clone detection. In Proceedings of the 2015 International Symposium on Software Testing and Analysis. 71–82.
[77]
Haoyu Wang, Hao Li, and Yao Guo. 2019. Understanding the evolution of mobile app ecosystems: A longitudinal measurement study of google play. In The World Wide Web Conference. 1988–1999.
[78]
Haoyu Wang, Hao Li, Li Li, Yao Guo, and Guoai Xu. 2018. Why are Android Apps Removed From Google Play? A Large-scale Empirical Study. In The 15th International Conference on Mining Software Repositories (MSR 2018).
[79]
Haoyu Wang, Zhe Liu, Yao Guo, Xiangqun Chen, Miao Zhang, Guoai Xu, and Jason Hong. 2017. An explorative study of the mobile app ecosystem from app developers’ perspective. In Proceedings of the 26th International Conference on World Wide Web. 163–172.
[80]
Haoyu Wang, Zhe Liu, Jingyue Liang, Narseo Vallina-Rodriguez, Yao Guo, Li Li, Juan Tapiador, Jingcun Cao, and Guoai Xu. 2018. Beyond google play: A large-scale comparative study of chinese android app markets. In Proceedings of the Internet Measurement Conference 2018. 293–307.
[81]
Haoyu Wang, Xupu Wang, and Yao Guo. 2019. Characterizing the global mobile app developers: a large-scale empirical study. In 2019 IEEE/ACM 6th International Conference on Mobile Software Engineering and Systems (MOBILESoft). IEEE, 150–161.
[82]
Chengpeng Zhang, Haoyu Wang, Ran Wang, Yao Guo, and Guoai Xu. 2018. Re-checking App Behavior against App Description in the Context of Third-party Libraries. In SEKE. 665–664.

Cited By

View all
  • (2024)Massively Parallel Evasion Attacks and the Pitfalls of Adversarial RetrainingEAI Endorsed Transactions on Internet of Things10.4108/eetiot.665210Online publication date: 17-Jul-2024
  • (2024)"I tend to view ads almost like a pestilence": On the Accessibility Implications of Mobile Ads for Blind UsersProceedings of the IEEE/ACM 46th International Conference on Software Engineering10.1145/3597503.3639228(1-13)Online publication date: 20-May-2024
  • (2024)Symbolic Prompt Tuning Completes the App Promotion GraphMachine Learning and Knowledge Discovery in Databases. Applied Data Science Track10.1007/978-3-031-70381-2_12(183-198)Online publication date: 22-Aug-2024
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences
WWW '20: Proceedings of The Web Conference 2020
April 2020
3143 pages
ISBN:9781450370233
DOI:10.1145/3366423
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 20 April 2020

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. Android app
  2. ad fraud
  3. malware
  4. mobile advertising

Qualifiers

  • Research-article
  • Research
  • Refereed limited

Conference

WWW '20
Sponsor:
WWW '20: The Web Conference 2020
April 20 - 24, 2020
Taipei, Taiwan

Acceptance Rates

Overall Acceptance Rate 1,899 of 8,196 submissions, 23%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)106
  • Downloads (Last 6 weeks)7
Reflects downloads up to 30 Aug 2024

Other Metrics

Citations

Cited By

View all
  • (2024)Massively Parallel Evasion Attacks and the Pitfalls of Adversarial RetrainingEAI Endorsed Transactions on Internet of Things10.4108/eetiot.665210Online publication date: 17-Jul-2024
  • (2024)"I tend to view ads almost like a pestilence": On the Accessibility Implications of Mobile Ads for Blind UsersProceedings of the IEEE/ACM 46th International Conference on Software Engineering10.1145/3597503.3639228(1-13)Online publication date: 20-May-2024
  • (2024)Symbolic Prompt Tuning Completes the App Promotion GraphMachine Learning and Knowledge Discovery in Databases. Applied Data Science Track10.1007/978-3-031-70381-2_12(183-198)Online publication date: 22-Aug-2024
  • (2023)ANDetect: A Third-party Ad Network Libraries Detection Framework for Android ApplicationsProceedings of the 39th Annual Computer Security Applications Conference10.1145/3627106.3627182(98-112)Online publication date: 4-Dec-2023
  • (2023)Understanding Dark UI Patterns in the Mobile Ecosystem: A Case Study of Apps in ChinaProceedings of the 2023 ACM Workshop on Secure and Trustworthy Superapps10.1145/3605762.3624431(33-40)Online publication date: 26-Nov-2023
  • (2023)Demystifying Hidden Sensitive Operations in Android AppsACM Transactions on Software Engineering and Methodology10.1145/357415832:2(1-30)Online publication date: 29-Mar-2023
  • (2023)Are Mobile Advertisements in Compliance with App’s Age Group?Proceedings of the ACM Web Conference 202310.1145/3543507.3583534(3132-3141)Online publication date: 30-Apr-2023
  • (2023)Not Seen, Not Heard in the Digital World! Measuring Privacy Practices in Children’s AppsProceedings of the ACM Web Conference 202310.1145/3543507.3583327(2166-2177)Online publication date: 30-Apr-2023
  • (2023)DroidSecTester: Towards context-driven modelling and detection of Android application vulnerabilities2023 IEEE 34th International Symposium on Software Reliability Engineering Workshops (ISSREW)10.1109/ISSREW60843.2023.00063(136-141)Online publication date: 9-Oct-2023
  • (2023)ReSPlay: Improving Cross-Platform Record-and-Replay with GUI Sequence Matching2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE)10.1109/ISSRE59848.2023.00056(439-450)Online publication date: 9-Oct-2023
  • Show More Cited By

View Options

Get Access

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

HTML Format

View this article in HTML Format.

HTML Format

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media