An empirical study of third party APK's URL using scriptable API and fast identifier-specific filter

With rising popularization of Android application, third party of APK market has become attractive target of attackers. There have been many research efforts on analyzing APK malware and malformed advertisement. However, so far, the empirical study of the large number of APKs distributed by third party market has not been discussed in detail. In this paper, we present a framework to inspect URL strings to which third party APK connects using headless browser and fast URL filter. In our system, for collecting APK files, navigation scripting with JavaScript enables more interactive web page crawling in order to fetch the results after dynamic web page loading. Besides, FARIS (fast uniform resource identifier-specific filter) is applied for matching URL strings in APK with black list in AdBlock Plus which is one of the most popular ad blockers. We show a result of empirical study of distribution of destination URLs of third party Android applications. Experimental results show that our system can process with reasonable response time for fetching files with scriptable API and filters URL string with feasible computing time compared with previous string matching method such as regular expression.