Dolandırıcılık Amaçlı Android Uygulama Tespiti: Çok Boyutlu Davranışsal Özelliklere Dayalı Sistematik Bir Çerçeve

Özet (abstract)

Abstract Fraudulent Android applications have become the primary vector for online financial fraud, while existing detection methods remain ineffective against three adversarial techniques: (1) TLS 1.3 with certificate pinning, which blocks traffic interception; (2) environment-aware evasion, which disables malicious payloads in sandboxes; (3) rapid code obfuscation and repackaging, which shorten the effective window of static signatures. This paper presents a unified detection framework that counters these evasions through three dimensions. First, we design an evasion-aware dynamic sandbox that integrates kernel-level eBPF traffic interception with transparent TLS decryption. Second, we build a multi-dimensional behavioral graph (SDK-Permission-API) that captures hidden intent chains invisible to static analysis. Third, a time-decay risk propagation algorithm, termed RiskRank, is applied to a threat knowledge graph of 15,247 entities that jointly considers behavioral weight, graph association, and sample recency, improving the detection of fast-evolving fraud. We evaluate the framework on 2000 real-world Android applications, comprising 1000 fraudulent and 1000 benign samples, of which 68% are packed or obfuscated. Our system achieves 96.8% detection accuracy and 98.6% AUC-ROC, outperforming 6 state-of-the-art baselines by 8–16 percentage points. The system processes a sample in 128s on average, supporting 32 concurrent analyses for operational deployment.

Yazarların özeti; kaynağından alınmıştır. Cybersecurity, 2026 · DOI ↗