陈浩-Security and Privacy in Mobile Advertising-移动安全发展论坛

SecurityandPrivacyinMobileAdvertising

HaoChen

UniversityofCalifornia,

Davis

AdsaretheFinancialPillarofMobileComputing

Mostmobilesoftwareisfree.

•Android

•Mostapps

Wheredoesrevenuecome?

•In-apppurchase

•Ads

MobileAdsEcosystem

Parties

•Users

•Appdevelopers

•Adproviders

•Advertisers

SecurityProblems

ˆ

•Appdevelopers:adrevenuediversionduetocloning

•Adproviders/advertisers:adfraud

AnatomyofMobileAdTraffic

AdRevenueDiversion

Cloningharmsappecosystem

•Developers:loserevenueandincentivestomakeapps

•Markets:pollutedsearchresults

•Users:difficulttofindhighqualityapps

AdRob

Goals

Characterizeclonedapps

•Market

•Appcategory

•Adprovider

Quantifyimpactondevelopers

•Lossofadrevenue

•Lossofuserbase

Dataset:265,000appsfrom17markets

CloningbetweenMarkets

Found

•>5,000clustersofclones

•>44,000uniqueapps

CloningonEachMarket

DetermineImpact

•Naivequestion

Howmanytimeshasanappbeen

cloned?

•Betterquestion

Howmanypeopleuseaclonedapp

insteadoftheoriginal?

HowtoDetermineImpact

•Counttheusersrunningeachapp.

•Determinetheownershipofeachapp.

•Classifyoriginalvs.plagiarizedapps.

CountUsersRunningEachApp

Potentialvantagepoints

•Onthedevice

•Ontheappserver

•Onthenetwork

CountUsersRunningEachapp

Combinetrafficanalysiswithstaticanalysis

Onthenetwork

•Captureadtraffic

•ExtractclientIDs

Inthelab,foreachapp

•ExtractclientID

•Determinewhetheritisoriginalorclone

AdRob

TrafficAnalysis

•CollaboratedwithamajorUScellularprovider.

•Captured2.6billionpacketsin12days.

•Removedalluser-identifyinginformation.

LossofRevenueandUserBase

WebAdFraud

Programsthatautomatically“view”adsand“click”them

MobileAdFraud

Appsthatautomatically“view”adsand“click”them

MAdFraud

Goals

•Designsystemforautomaticallydetectingadtraffic

•Usesystemtodetectfraudandotherundesirableadbehavior

AdFraud

•Impressionfraud:requestadswheninthebackground.

•Clickfraud:clickonadswithoutuserinteraction.

MAdFraud

DynamicAnalysis

Foreachapp:

•Createanemulatorandinstalltheapp

•Runappintheforegroundfor1minute

•UseanIntenttomovetheappintothebackground

•Runappinthebackgroundfor1minute

•Captureallnetworktrafficthroughout

Neverinteractwithapptoensurealldetectedclicksarefraudulent

IdentifyImpressionsandClicks

Simpleapproach

•ReverseengineeradlibrariestofindadrequestandclickURLs

•UseURLstocountthenumberofimpressionsandclicks

Problems

•Timeintensiveforthemanyadlibraries(80+)

•Lackcontext

•Wastheadresold?

•Wastheclickproceededbyanimpression?

AutomaticallyIdentifyImpressionsandClicks

Buildrequesttrees

Identifyimpressionsusingmachinelearningbasedon

•Requesttreeproperties

•Queryparameters

•HTTPproperties

Identifyclicksbasedonrequesttreesandimpressions.

DatasetandResultsOverview

Dataset

150,000appscrawledfrom19markets

Finding:BackgroundImpressions

12,421appsmakeimpressionsinthebackground

Finding:ClickFraud

Prevention

Appcloning

•Market-scaleincrementalclonedetection

Adfraud

•Includeproofsofuserviewingorclickingprovidedbytrustedsoftware.

Conclusion

•Adsarecrucialforsustaining