Careful About What App Promotion Ads Recommend! Detecting and Explaining Malware Promotion via App Promotion Graph

2024-10-10

arXiv.org

AI Summary

To address the security threat posed by malicious advertising campaigns in Android applications—where ad networks are abused to distribute malware—this paper proposes an end-to-end detection and attribution framework grounded in application promotion graphs. Methodologically, it pioneers a hybrid approach integrating UI-driven dynamic exploration (via DroidBot) with heterogeneous graph modeling to construct fine-grained promotion relationship graphs; a Graph Attention Network (GAT) is then employed for malicious link identification, augmented by explainable subgraph mining to support root-cause attribution of promotion mechanisms. Evaluated on 18,627 real-world promotional ad samples, the framework achieves 92.3% detection accuracy and successfully reconstructs multiple cross-application stealthy malicious promotion paths. It represents the first systematic revelation of coordinated security risks within the mobile advertising ecosystem. This work establishes a scalable and interpretable paradigm for malicious ad detection in modern app distribution infrastructures.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Computer Vision: Adversarial Attacks & Robustness
• Application Domains: Misinformation & Fake News

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

In Android apps, their developers frequently place app promotion ads, namely advertisements to promote other apps. Unfortunately, the inadequate vetting of ad content allows malicious developers to exploit app promotion ads as a new distribution channel for malware. To help detect malware distributed via app promotion ads, in this paper, we propose a novel approach, named ADGPE, that synergistically integrates app user interface (UI) exploration with graph learning to automatically collect app promotion ads, detect malware promoted by these ads, and explain the promotion mechanisms employed by the detected malware. Our evaluation on 18, 627 app promotion ads demonstrates the substantial risks in the app promotion ecosystem.

Problem

• Mobile Advertising
• Malware Detection
• APP Ecosystem

Innovation

• ADGPE
• Malware Campaigns
• App Advertising Security