5.3 Result of Ad fraud detection
5.3.2 Result of Size violation Ad fraud
國
立 政 治 大 學
‧
N a tio na
l C h engchi U ni ve rs it y
Figure 16: Example of call Ad view
Figure 17: Count in Ad view node
5.3.2 Result of Size violation Ad fraud
In the 320 Ad view nodes, it calls ad-view function to set size 7055 times. It means that we will generate the dependency graph of the first parameter of these Ad view function 7055 times (shown in Figure 18). The intersections between the two automata are 4052 true results, while 3003 are not. In the true results, 3904 of them contain unknown nodes, and 148 of them are not contained. The 60 violate behaviors happen in 48 apps.
In these 48 apps, we check that their behaviors of violating Size violation Ad fraud are 148 times in not unknown true results and 3904 times in unknown true results. The number of sinks and apps is classified by string operation type (Directly(Constant
Pro-‧
國立 政 治 大 學
‧
N a tio na
l C h engchi U ni ve rs it y
Figure 18: Count in Size violation Ad fraud
portion), Union, Concat). The number of violating Size violation Ad fraud is shown in Figure 19 and Figure 20. The not unknown sink in Figure 19 means the behavior of vio-lating Size violation Ad fraud in not unknown true results. There are 101 times in Direct type, 46 in Union type and 1 time in Concat type. It is the same definition in Figure 19 but it represents the unknown results. There are 1834 times in Direct type, 2038 times in Union type and 32 times in Concat type in unknown true results.
Figure 19: Count in Size violation Ad fraud (NotUnknown) by Operation type
The apps number in Figure 19 and Figure 20 are the unique number within the different string operation types. An app may contain a violation in different operation types, so the total unique apps for Size violation Ad fraud in Figure 19 and Figure 20 are not the same as the Size violation apps Number we mention in the section 5.3. We will show the violations of the Size violation group by apps in Table 5 to show what applications violate Size violation more times.
‧
Figure 20: Count in Size violation Ad fraud (Unknown) by Operation type
We want to know which apps violate Size violation more severely, so we record Table 5 to present the result. We know that there are 4052 times Size violations. App 335445524 violates 396 times, which is the most severe app in these Size violations apps (Shown in Table 5). The column operation(directly, union, concat) next to not unknown violations and unknown violations shows the count of dependency graphs divided by operations types. A detailed description will be given as follows.
Table 5: Top 20 Size violation apps Table
cfgId violation violation-notunknown (directly,union,concat) violation-unknown (directly,union,concat) unknown-node
335445524 396 18 (15,2,1) 378 (208,166,4) 490
469489347 387 7 (2,5,0) 380 (190,188,2) 483
1077052682 278 15 (12,3,0) 263 (115,143,5) 417
299515267 271 17 (12,5,0) 254 (131,120,3) 380
964603202 270 16 (13,3,0) 254 (131,121,2) 327
486095973 247 19 (12,7,0) 228 (98,129,1) 297
480095719 245 14 (11,3,0) 231 (113,116,2) 350
935182144 183 3 (1,2,0) 180 (95,85,0) 232
680500587 161 1 (0,1,0) 160 (56,104,0) 243
535701918 159 8 (4,4,0) 151 (57,94,0) 219
1080972124 148 3 (1,2,0) 145 (74,71,0) 176
882119723 145 1 (0,1,0) 144 (73,70,1) 207
290051590 106 6 (5,1,0) 100 (30,70,0) 127
445853367 104 3 (3,0,0) 101 (53,47,1) 157
680555553 86 1 (0,1,0) 85 (39,46,0) 144
466317305 62 4 (0,4,0) 58 (30,28,0) 61
491594085 47 2 (2,0,0) 45 (17,28,0) 85
1094112261 45 5 (3,2,0) 40 (17,23,0) 59
392550386 18 4 (4,0,0) 14 (6,7,1) 14
528532387 13 1 (1,0,0) 12 (4,6,2) 14
Record the table with the violation We will explain how we record when we detect the violation in the dependency graph 21. We can see that the operation type of depen-dency graph is Concat. It uses Concat operation to concatenation two strings ”CGRec”
and ”tZero”. CGRectZero is the V iolateSize we described in algorithm 5. We will regard
‧
國立 政 治 大 學
‧
N a tio na
l C h engchi U ni ve rs it y
Figure 21: Size violation Dependency Graph 1
this behavior of using setView functions to set abnormal size as Size violation. We record this DPG in Table 5 like: Add one time in column violation, add one time in column not unknown and add (0,0,1) in column operation(directly, union, concat) in the row of cfgId 335445524.
The column unknown in Table 5 will show the unknown results of these apps in 4255 true results. The unknown results represent the count of unknown DPGs, which contain at least one unknown node in the dependency graph. The column operation(directly, union, concat) next to column unknown is the count of unknown dependency graphs divided by operations types. The column unknown-node shows the total number of unknown nodes in these unknown dependency graphs.
Figure 22: View with Ad of app 335445524
‧
Figure 23: View without Ad of app 335445524
We also record the detailed information of these Size violation apps in Table 6. We download the most severe app to check the reason why it violates Size violation Ad fraud.
The name of the app is Backgammon and the genre of it is Games. We download it from the link showed in Table 6. We think there is a possible view of Size violation Ad fraud in this app after we launch it. It contains an Ad view on the page when we want to start the game Backgammon. However, the Ad does not show each time when we enter the view but we think it should. Size violation Ad fraud has occurred at the moment we cannot see the Ad view. That is to say, the Ad is too small to see at that moment. Figure 22 is the view including Ads. However, the Ads do not show each time like Figure 23.
Table 6: Related information of Top 20 Size violation apps table
cfgId file size genre link
335445524 64663552 Games https://itunes.apple.com/us/app/backgammon-free/id335445524?mt=8&uo=4 469489347 77606912 Lifestyle https://itunes.apple.com/us/app/apptrailers/id469489347?mt=8&uo=4 1077052682 90675200 Games https://itunes.apple.com/us/app/hidden-objects-secret-garden/id1077052682?mt=8&uo=4
299515267 36454400 Food & Drink https://itunes.apple.com/us/app/allrecipes-dinner-spinner/id299515267?mt=8&uo=4 964603202
‧
國立 政 治 大 學