Using Ad-Related Network Behavior to Distinguish Ad Libraries
Source abstract
Abstract
Mobile app ads pose a far greater security threat to users than adverts on computer browsers. This is because app developers must embed a Software Development Kit (SDK), called an ad library or ad lib for short, provided by ad networks (i.e., ad companies) into their app program, and then merge and compile it into an Android PacKage (APK) execution file. The ad lib thus becomes a part of the entire app, and shares the whole permissions granted to the app. Unfortunately, this also resulted in many security issues, such as ad libs abusing the permissions to collect and leak private data, ad servers redirecting ad requests to download malicious JavaScript from unknown servers to execute it in the background of the mobile operating system without the user’s consent. The more well-known an embedded ad lib, the safer the app may be, and vice versa. Importantly, while decompiling an APK to inspect its source code may not identify the ad lib(s), executing the app on a simulator can reveal the network behavior of the embedded ad lib(s). Ad libs exhibit different behavior patterns when communicating with ad servers. This study uses a dynamic analysis method to inspect an executing app, and plots the ad lib behavior patterns related to the advertisement into a graph. It is then determined whether or not the ad lib is from a trusted ad network using comparisons of graph similarities.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Software Testing and Debugging Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Science and Information Engineering, Ming Chuan University, Taoyuan 333, Taiwan
References (37)
Show source-provided references
1. (2018, October 07). IAB Internet Advertising Revenue Report—2016 Full Year Results. Available online: https://www.iab.com/wp-content/uploads/2016/04/IAB_Internet_Advertising_Revenue_Report_FY_2016.pdf.
2. (2018, October 07). Millennial Media: State of the Apps Industry Snapshot 2015. Available online: http://visionmediainteractive.com/millennial-medias-state-of-the-apps-industry-snapshot-2015/.
3. (2018, October 07). Mobile Malware Evolution 2016. Available online: https://securelist.com/analysis/kaspersky-security-bulletin/77681/mobile-malware-evolution-2016/.
4. (2018, October 07). Trend Micro Detects Xavier Android Malware in 800 Mobile Apps Downloaded from Google Play Store. Available online: https://cio.economictimes.indiatimes.com/news/digital-security/trend-micro-detects-xavier-android-malware-in-800-mobile-apps-downloaded-from-google-play-store/59284441.
5. (2018, October 07). Dr. WEB Anti-Virus, New Trojan Found in 155 Apps on Google Play: 2.8 Million Mobile Devices Already Infected. Available online: https://news.drweb.com/show/?i=10115&lng=en.
6. NaClDroid: Native Code Isolation for Android Applications
7. Kumar, P., and Singh, M. (2015, January 10–13). Mobile Applications: Analyzing Private Data Leakage Using Third Party Connections. Proceedings of the IEEE Proceedings of International Conference on Advances in Computing, Communications and Informatics (ICACCI), Kochi, India.10.1109/ICACCI.2015.7275584 ↗
8. Gao, X., Liu, D., Wang, H., and Sun, K. (October, January 28). PmDroid: Permission Supervision for Android Advertising. Proceedings of the 34th Symposium on Reliable Distributed Systems, Montreal, QC, Canada.
9. Narayanan, A., Chen, L., and Chan, C.-K. (2014, January 21–24). AdDetect: Automated Detection of Android Ad Libraries using Semantic Analysis. Proceedings of the IEEE Ninth International Conference on Intelligent Sensors, Sensor Networks and Information Processing (ISSNIP), Singapore.10.1109/ISSNIP.2014.6827639 ↗
10. Liu, B., Liuy, B., Jin, H., and Govindan, R. (2015, January 18–22). Efficient Privilege De-Escalation for Ad Libraries in Mobile App. Proceedings of the 13th Annual International Conference on Mobile Systems, Applications, and Services, Florence, Italy.10.1145/2742647.2742668 ↗
11. RTDroid: A Design for Real-Time Android10.1109/TMC.2015.2499187 ↗
12. Book, T., and Wallach, D.S. (2013, January 8). A Case of Collusion: A Study of the Interface between Ad Libraries and their Apps. Proceedings of the International Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM), Berlin, Germany.10.1145/2516760.2516762 ↗
13. Ruiz, I.J.M., Nagappan, M., Adams, B., Berger, T., Dienst, S., and Hassan, A.E. (2017). On Ad Library Updates in Android Apps. IEEE Softw.
14. De-cloaking Malicious Activities in Smartphones Using HTTP Flow Mining
15. Kuzuno, H., and Magata, K. (2014, January 3–5). Detecting Advertisement Module Network Behavior with Graph Modeling. Proceedings of the Ninth Asia Joint Conference on Information Security, Wuhan, China.10.1109/AsiaJCIS.2014.26 ↗
16. Kajiwara, N., Kawamoto, J., Matsumoto, S., Hori, Y., and Sakurai, K. (2015, January 12–14). Detection of Android Ad Library Focusing on HTTP Connections and View Object Redraw Behaviors. Proceedings of the IEEE International Conference on Information Networks (ICOIN), Cambodia.10.1109/ICOIN.2015.7057865 ↗
17. Crussell, J., Stevens, R., and Chen, H. (2014, January 16–19). MAdFraud: Investigating Ad Fraud in Android Applications. Proceedings of the 12th International Conference on Mobile Systems, Applications, and Services, Bretton Woods, NH, USA.10.1145/2594368.2594391 ↗
18. Song, Y., and Hengartner, U. (2015, January 12). PrivacyGuard: A VPN-based Platform to Detect Information Leakage on Android Devices. Proceedings of the ACM Workshop on Security and Privacy in Smartphones and Mobile Devices, Denver, CO, USA.10.1145/2808117.2808120 ↗
19. Backes, M., Bugiel, S., and Derr, E. (2016, January 24–28). Reliable Third-Party Library Detection in Android and its Security Applications. Proceedings of the 23rd ACM Conference on Computer and Communications Security, Vienna, Austria.10.1145/2976749.2978333 ↗
20. Lee, J.-H., Jun, S.-Y., Park, S.-J., Kim, K.-M., and Lee, S.-K. (2017, January 19–23). Demo: Mobile Contextual Advertising Platform based on Tiny Text Intelligence. Proceedings of the 15th ACM International Conference on Mobile Systems, Applications, and Services (MobiSys), Niagara Falls, NY, USA.10.1145/3081333.3089326 ↗
21. Tang, J., Li, R., Han, H., Zhang, H., and Gu, X. (2017, January 1–4). Detecting Permission Over-claim of Android Applications with Static and Semantic Analysis Approach. Proceedings of the IEEE Trustcom/BigDataSE/ICESS, Sydney, NSW, Australia.10.1109/Trustcom/BigDataSE/ICESS.2017.303 ↗
22. Liu, X., Zhu, S., Wang, W., and Liu, J. (2017). Alde: Privacy Risk Analysis of Analytics Libraries in the Android Ecosystem, Springer.10.1007/978-3-319-59608-2_36 ↗
23. Stevens, R., Gibler, C., Crussell, J., Ericksonand, J., and Chen, H. (2012, January 24). Investigating User Privacy in Android Ad Libraries. Proceedings of the IEEE Mobile Security Technologies (MoST), San Francisco, CA, USA.
24. (2018, October 08). Mobile Web Usage Overtakes Desktop for First Time. Available online: https://www.telegraph.co.uk/technology/2016/11/01/mobile-web-usage-overtakes-desktop-for-first-time/.
25. (2018, October 07). Without Ads, Android Apps Could Be More Than Twice as Power-Efficient. Available online: http://www.theverge.com/2012/3/19/2884902/android-apps-battery-efficiency-study.
26. (2018, October 07). AppBrain, Android Ad Networks. Available online: http://www.appbrain.com/stats/libraries/ad.
27. Impact of Ad Libraries on Ratings of Android Mobile Apps10.1109/MS.2014.79 ↗
28. Wei, X., Neamtiu, I., and Faloutsos, M. (2015, January 6–10). Whom Does Your Android App Talk To?. Proceedings of the IEEE Global Communications Conference (GLOBECOM), San Diego, CA, USA.10.1109/GLOCOM.2015.7416952 ↗
29. (2018, October 07). Web of Trust. Available online: http://www.mywot.com/.
30. (2018, October 07). VirusTotal. Available online: https://www.virustotal.com/en/#url.
31. (2018, October 07). Ad Exchange. Available online: https://en.wikipedia.org/wiki/Ad_exchange.
32. Enck, W., Gilber, P., Chun, B., Cox, L.P., Jung, J., McDaniel, P., and Sheth, A.N. (2010, January 4–6). TaintDroid: An information-flow tracking system for realtime privacy monitoring on smartphones. Proceedings of the USENIX Symposium on Operating Systems Design and Implementation (OSDI), Vancouver, BC, Canada.
33. Blasing, T., Batyuk, L., Schmidt, A.D., Camtepe, S.A., and Albayrak, S. (2010, January 19–20). An Android application sandbox system for suspicious software detection. Proceedings of the 5th International Conference on Malicious and Unwanted Software (Malware 2010), Nancy, France.10.1109/MALWARE.2010.5665792 ↗
34. Liu, J., Liu, J., Li, H., Zhu, H., and Ruan, N. (2016, January 4–8). Who Moved My Cheese: Towards Automatic and Fine-Grained Classification and Modeling Ad Network. Proceedings of the Global Communications Conference (GLOBECOM), Washington, DC, USA.10.1109/GLOCOM.2016.7842384 ↗
35. Chan, J., Keng, J., Jiang, L., Wee, T.K., and Balan, R.K. (2016, January 14–15). Graph-aided directed testing of Android applications for checking runtime privacy behaviours. Proceedings of the 11th International Workshop on Automation of Software Test, Austin, TX, USA.
36. Android Permissions Management at App Installing
37. (2018, October 07). PChome. Available online: http://show.pchome.com.tw/pfb/.