Detecting fraud and user privacy-intrusive behavior in real-time with dynamic information of system API sequences

Abstract

Attackers use mobile apps and web pages to deceive users into gaining an unfair profit and collect users' personal information. For example, attackers can use mobile apps to obtain unfair advertising revenue, voice phishing using mobile apps, and collect users' web activity using third-party content. In this dissertation, we argue that the above fraud and privacy abusive behavior can be accurately detected with the information of the system API sequence. We present a method for detecting fraud and invasion of privacy with system function sequence information for three research topics. First, we accurately identify mobile ad fraud by calculating API sequential calls within the Android system that generated ad click and impression traffic. Second, we accurately identify the behavior of a new voice phishing app that changes the victim's outgoing call target to the attacker by observing the Android framework APIs. Finally, we classify adversarial attacks on the ad and tracker blocking ML model based on the explanation of the results of the AI ​​model.