# Sentinel: Automated Detection of Android Vishing Apps Using Optical Character Recognition
## 4 Design
### Sentry of Ventinel
#### 4.1.1 Duplicated Contacts Verification
Thus, while Call Blocker effectively shows the relevant phone number during call events, its inability to alert users to potential tampering or manipulations limits its effectiveness as a vishing defense tool. ```
1 publicvoidonReceive(ContextcontextIntententent){
2...
3 if(intent.getAction().equals(\"PHONE_STATE\")){
4...
5 Stringlastnum=DB.getString(lastnum,\"\");
6 StringcurNum=intent.getStringExtra(\"state\");
7...
8 if(!TelephonyManager,EXTRA_STATE_RINGING.equals(curNum)){
9 if(TelephonyManager.EXTRA_STATE_OFFHOOK.equals(curNum)){
10...
11}
12 StringinNum=intent.getStringExtra(\"incoming_number\");
13}
14}
15}
16}
```

Listing 2: Call Blocker detection code. ### User Study

To validate the proposed technique, we recruited 100 participants for Group A, who received vishing applications, and another 100 participants for Group B, who were provided with both vishing applications and Sentinel. All participants used Android devices, with the Android version randomly selected. Participants were recruited under the pretext of a study unrelated to vishing, ensuring they would not recognize the functioning of the vishing applications. After the experiment concluded, we informed them about the study's true nature and requested their participation in a survey regarding vishing. The experiment lasted one week, during which both incoming and outgoing calls were executed randomly. An incoming call was considered unanswered if the participant did not respond, while an outgoing call was counted as unanswered if the subject ended the call within five seconds after answering. As shown in Figure 7, Group A had an average response rate of approximately 64.7% across ten tests, whereas Group B exhibited an average response rate of only 8.9%. Each corresponding number represents the total number of responses in Group A and Group B divided by the number of trials. These results demonstrate that Sentinel effectively defends against vishing applications. ## 6 Discussion

Ventinel is engineered to detect attacks from vishing applications (Call Redirection, Display Overlay, and Duplicated Contacts) while operating in the background without necessitating modifications to the Android OS. Vishing applications utilize diverse attack strategies across different Android API levels. To address this, we conducted a detailed analysis of the malicious behavior patterns associated with various API levels and developed Sentinel to effectively identify and mitigate these threats. ### Lacking Visibility

In Section 5.4, Group B, which used Sentinel, exhibited an average response rate of 8.9%. Although the overall figure is notably low, we analyzed the experiment to understand why a specific part of Group B exhibited the high response rate. The analysis indicated that the signaller's warning window lacked sufficient visibility. Additionally, the widespread use of Bluetooth earphones and wearable devices led to instances where participants failed to notice the warnings. To address this issue, it is essential to enhance the delivery of alerts related to malicious activities by incorporating voice prompts or establishing a connection between the wearable device and the user's mobile phone for more effective notifications. ### Optimize Performance

We used ML Kit, which requires API level 21 or higher. If your device runs an API level below 21, this feature will not be available. Devices with API levels below 21 need

Figure 7: Response rate comparison between Group A (vishing app) and Group B (vishing app + Sentinel). to rely on alternative solutions like OpenCV. Additionally, since ML Kit's performance has been tested on a limited range of devices, it may encounter issues on less powerful hardware. Therefore, optimization is necessary for these devices. ### APIs Permission Settings

Ventinel functions entirely within the confines of the application and requires explicit user authorization to operate effectively. It is essential that we provide appropriate notification to users to ensure that all necessary permissions are granted.