Collaborative Ad Fraud Detection in Ad Networks

Mobile advertising has been significantly propelled by the advent of in-app programmatic advertising and Real-Time Bidding (RTB) technologies. However, it suffers from ad fraud incidents in ad networks, including click injection, covert background ad activities, and etc. While previous research has predominantly focused on ad fraud localized within individual apps or specific devices, this paper delineates a newly identified form of collusion-based ad fraud, termed ad attribution laundering fraud (ALF). ALF involves multiple apps conspiring to obfuscate the true origins of where advertisements are displayed, thereby allowing lower-quality apps to leverage the reputations of ostensibly legitimate ones. To detect ALF, we developed the detection tool, AlfScan-X, which efficiently identifies potential collaborative apps among millions in the wild by heuristically prioritizing candidate apps likely to be involved in ALF for prompt analysis. AlfScan-X maintains an online APK crawler and an $\textsf {AppID}$ database to enhance AlfScan-X’s responsiveness, adaptability, and reduce false negatives. Overcoming challenges of identity extraction from diverse and obfuscated apps, AlfScan-X utilizes a combination of static and dynamic analysis techniques to cross-verify app identities, pinpointing instances of ALF. Our evaluation of AlfScan-X on a 200-app ground truth dataset yielded high effectiveness with 92% precision and 92% recall. AlfScan-X identified $4,515$ unique fraudulent apps and $1,483$ fraudulent clusters, revealing significant patterns and implications of fraudulent apps and highlighting reliability issues in both third-party app development frameworks and advertising networks.