# Sentinel: Automated Detection of Android Vishing Apps Using Optical Character Recognition
## 1 Introduction  
Vishing, a portamenteau of \"Voice\" and \"Phishing\", has evolved with advancements in technology, allowing attackers to employ additional phishing channels such as web, Short Message Service (SMS), and email for more sophisticated scans [1]. These techniques have continued to result in annual losses amounting to millions of dollars for both individuals and organizations [2, 3]. The emergence of attacks utilizing vishing applications has significantly escalated the fraud landscape; leveraging these applications has been shown to incur losses up to ten times greater than those caused by traditional phishing campaigns that do not utilize such apps [4]. With the proliferation of vishing applications, the most commonly observed attack methods have been the Call Redirection Attack and the Display Overlay Attack [4]. Firstly, the Call Redirection Attack involves redirecting the number dialed by the user to the attacker's phone number. However, since the attacker's phone number would appear on the user's outgoing call screen, this method is often combined with a Display Overlay Attack for added deception. The Display Overlay Attack, on the other hand, is used to conceal the attacker's phone number by overlaying a fake waiting screen during incoming or outgoing calls [5]. By masking the real phone number with a counterfeit screen, users are less likely to notice discrepancies, thereby increasing the likelihood of them divulging personal information without suspicion. Additionally, we defined a new attack: Duplicated Contacts Attack. This attack involves registering the attacker's phone number under acontact name that matches a target contact's name or editing an existing contact on the target's device to insert the attacker's phone number. In previous research, due to the lack of clearly defined vishing attack techniques, researchers explored various dimensions of vishing and investigated user behavior in response to these threats. Based on these studies, research has been conducted to enhance users' security awareness, focusing on enabling individuals to recognize and respond to phishing attempts. These include user studies analyzing why individuals respond (or do not respond) to vishing attempts [6], research aimed at increasing awareness of mobile scams through education [7], and detailed crime reports explaining how attackers succeeded in their fraudulent schemes [8]. However, the emergence of vishing applications has introduced new attack vectors, such as Call Redirection and Display Overlay Attacks, leaving gaps in the existing body of research. To fill these gaps, an approach involving modifications to the Android Operating System (OS) was proposed, which monitors specific Application Programming Interfaces (API) to detect malicious behaviors [4]. However, this method requires users to directly alter the Android OS, which poses a significant barrier to adoption. Additionally, it is limited to monitoring specific APIs used in malicious techniques. If Google introduces new APIs with similar functionalities, this approach would fail to detect them. There has also been research utilizing Large Language Models (LLMs) to assist victims in responding to vishing attempts. However, these approaches face challenges due to limited training data, which introduces biases and reduces the reliability of the results [9]. In this work, Sentinel focuses on monitoring the user's screen to defend against Display Overlay and Call Redirection Attacks. When an incoming call is detected, Sentinel uses Optical Character Recognition (OCR) to compare the number displayed on the user's screen with the incoming number to detect the Display Overlay Attack. Additionally, when an outgoing call is initiated, Sentinel compares the number dialed by the user with the number that successfully connects, which allows it to detect the Call Redirection Attack.