5.3 Result of Ad fraud detection
5.3.3 Result of Multi-view violation Ad fraud
國
立 政 治 大 學
‧
N a tio na
l C h engchi U ni ve rs it y
5.3.3 Result of Multi-view violation Ad fraud
We find 46 apps have called addsubview 213 times to add an Ad view. In 213 times, there are 64 have called addSubView to add Ad view more than one time (shown in Figure 24).
In summary, there are 31 apps violate Multi-view violation Ad fraud.
Figure 24: Count in Multi-view violation Ad fraud
We also present a pie chart to show the number of severe apps. In 213 times, 2 apps called addSubView to add more than 10 ad views on a page. 10 apps add 3-10 ad views and 54 apps add two ad views. They all violate Multi-view violation of Ad fraud. The rest of 147 apps called addSubView to add only one Ad, they do not violate the fraud.
Figure 25: App number in each times of Multi-view violation Ad fraud
First, we find the ViewController nodes which represent the views that users will touch and see in an application. Then we detect their behaviors by performing algorithm 6. We
‧
get the addSubView functions of the ViewController nodes and build dependency graphs on the parameters of these functions. If the parameters of addSubView functions are one of the Ad view nodes we found in algorithm 4, we will record the result as Table 7 shown.
CFG (control flow graph) can stand for an app, so we use cfgId column as the unique id of an app. The nodeId column means the ViewController node Id we find in a control flow graph. A View Controller Node may call addSubView multiple times to add table view, banner view and so on. We are only interested that the number of the Ad views it adds on a ViewController node. We will add one time in callTimes column when we detect the ViewController node use addSubView to add an Ad view, that is to say, there will be an advertisement in the View.
If View Controller Node calls addSubView to add Ad view more than one time, it will be a Multi-view violation Ad fraud. In other words, if the number of callTimes column in Table 7 above or equal two, it will be a violation. The origin table contains 213 records, but we only show the 12 records in which callTimes are above three times in Table 7.
That is to say, the 12 records show that they contain more than three advertisements in a view.
Table 7: Multi-view violation apps Table (callTimes above 2)
cfgId nodeId callTimes callTimes-ad(directly,union) callTimes-unknown(directly) unknown-nodes
299515267 18368 27 21(16,5) 6 6
299515267 17973 11 9(7,2) 2 2
469489347 75356 9 6(6,0) 4 4
591141063 113330 7 5(3,2) 2 2
591141063 9465 6 3(1,2) 3 3
299515267 4714 4 4(4,0) 0 0
299515267 18370 4 4(4,0) 0 0
299515267 12718 4 3(3,0) 1 1
469489347 92947 3 3(3,0) 0 0
299515267 20118 3 3(3,0) 0 0
1063190011 10953 3 2(2,0) 1 1
1077052682 56748 3 2(2,0) 1 1
Then we record the column callTimes-ad(directly,union), callTimes-unknown(directly) and unknown-nodes. callTimes-ad and callTimes-unknown represent the ad view nodes added by addSubView functions belong to the constants of Ad relate API or unknown.
The (directly, union) for callTimes-ad means that the numbers of the dependency graphs according to its operation(directly, union). Since we only found the DPGs of unknown are
‧
國立 政 治 大 學
‧
N a tio na
l C h engchi U ni ve rs it y
all called by directly, we only remark (directly) after callTimes-unknown but not writing 6(6). The operation of DPGs of unknown will also contain directly and union in Table 9.
We will describe it in section 5.3.4.
Figure 26: Multi-view violation Dependency Graph 2
We show the dependency graph node added by addSubView in the Figure 4 and 26.
App 299515267 use addSubView to add this dependency graph node showed as the Figure 4. We can find it is Ad U nion dependency graph(DPG). That is to say, there is a union node in this DPG(union operation means that it depends on one of the nodes it connects), and the parameters of the NSClassFromString function(top of the DPG) can be string FBAdView, FBAdBannerView, FBAdLink or FBAdNativeAd. App 299515267 add this view on the page, so we record it in the Table 7 as follows: callTimes add one time, callTimes-ad add one time, and callTimes-ad(union) add one time.
App 469489347 adds the DPG node shown in Figure 26. It is a U nknown Directly dependency graph. We still add this unknown node result in Table 7, since it belongs to Ad view node probably [68]. We can find there is only an unknown node in this DPG, so the numbers of unknown nodes recorded in column unknown-node in the Table 7 are the same as the number of the unknown dependency graph recorded in column callTime-unknown.
We record this DPG in the Table 7 as follows: callTimes add one time, callTimes-unknown add one time, callTimes-ad(directly) add one time and unknown-nodes add one time.
‧
Table 8: Related information of Multi-view violation apps Table
cfgId file-size genre link
299515267 36454400 Food & Drink https://itunes.apple.com/us/app/allrecipes-dinner-spinner/id299515267?mt=8&uo=4 335445524 64663552 Games https://itunes.apple.com/us/app/backgammon-free/id335445524?mt=8&uo=4 591141063 55199744 Lifestyle https://itunes.apple.com/us/app/zillow-digs-home-design-paint/id591141063?mt=8&uo=4 1076393796 52721664 Food & Drink https://itunes.apple.com/us/app/oriente-express/id1076393796?mt=8&uo=4 1077329297 52561920 Food & Drink https://itunes.apple.com/us/app/portal-chines-sushi/id1077329297?mt=8&uo=4 1077338562
1077339816 53278720 Food & Drink https://itunes.apple.com/us/app/bode-do-pepeu/id1077339816?mt=8&uo=4 1077343458 52918272 Food & Drink https://itunes.apple.com/us/app/acai-mix-setubal/id1077343458?mt=8&uo=4 1077349526 52828160 Food & Drink https://itunes.apple.com/us/app/gusttare/id1077349526?mt=8&uo=4 1077717174 53262336 Food & Drink https://itunes.apple.com/us/app/villa-cafe/id1077717174?mt=8&uo=4 1077726488 52819968 Food & Drink https://itunes.apple.com/us/app/haruo-temakeria/id1077726488?mt=8&uo=4 1078230776 52918272 Food & Drink https://itunes.apple.com/us/app/kazue-temakeria/id1078230776?mt=8&uo=4 1078232019 52656128 Food & Drink https://itunes.apple.com/us/app/subway-piedade-jaboatao/id1078232019?mt=8&uo=4 1078238850 53381120 Food & Drink https://itunes.apple.com/us/app/pizzaria-da-familia/id1078238850?mt=8&uo=4 1078239302 53164032 Food & Drink https://itunes.apple.com/us/app/sabor-do-crepe/id1078239302?mt=8&uo=4 1078240228
1078240902 52639744 Food & Drink https://itunes.apple.com/us/app/villa-foria/id1078240902?mt=8&uo=4 1078240930 53729280 Food & Drink https://itunes.apple.com/us/app/norte-burguer/id1078240930?mt=8&uo=4 1078241141 52766720 Food & Drink https://itunes.apple.com/us/app/e2-alimentacao-saudavel/id1078241141?mt=8&uo=4 1078242958 52729856 Food & Drink https://itunes.apple.com/us/app/vics-hot-dog/id1078242958?mt=8&uo=4 1078243139 52938752 Food & Drink https://itunes.apple.com/us/app/comedoria-da-pizza/id1078243139?mt=8&uo=4 1078244025 52844544 Food & Drink https://itunes.apple.com/us/app/dgianni-pizzaria/id1078244025?mt=8&uo=4
469489347 77606912 Lifestyle https://itunes.apple.com/us/app/apptrailers/id469489347?mt=8&uo=4
1063190011 42561536 Finance https://itunes.apple.com/us/app/trend-epaper-lust-auf-wirtschaft/id1063190011?mt=8&uo=4 1077052682 90675200 Games https://itunes.apple.com/us/app/hidden-objects-secret-garden/id1077052682?mt=8&uo=4
Besides the information in Table 7, we will show the related information of 31 apps violated Multi-view violation Ad fraud in Table 8. CfgId column will be used to link the information between the Table 7 and Table 8. File-size, genre and link are also significant information for the apps. Most types of apps violated Multi-view violation Ad fraud is Food and Drink. With the link, we can find more detail information about the apps we interested in.
In Multi-view violation apps, we try to download severe applications such as 299515267 and 469489347. App 299515267 is an app that contains a lot of receipts. We can find the receipts we interested in the app. After we open the app, it will give us a list of receipts that we can click each of it for more detailed information. The view of detailed information is like Figure 1. We can see it displays not only the receipts but also the multiple advertisements in a view. It will violate Multi-view violation. There is similar behavior in app 469489347. Users finish the tasks given in app 469489347 for the coupons or money. Most of the tasks are asking the users to download the apps from the list they provide. We can see that it will show an ad in each column of the list, That is to say, it contains multiple advertisements in the list view, so it violates Multi-view violation.
‧
國立 政 治 大 學