# Sentinel: Automated Detection of Android Vishing Apps Using Optical Character Recognition
## 4 Design
### Sentry of Ventinel
#### 4.1.1 Duplicated Contacts Verification
Additionally, when saving a number with an identical name, the Android system does not display a notification or message, potentially preventing the user from realizing that an unwanted contact has been added. #### 5.2.2 Incoming Call

A vishing application leverages Display Overlay to alter the caller ID displayed when an attacker places a call to the user. This attack follows the steps outlined in Figure 5. Initially, the application monitors changes in phone state to detect when an incoming call event begins 1. Once an incoming call event triggers and the phone state changes to

Figure 4: Duplicated Contacts Attack operation. Figure 3: CPU and memory usage with and without Ventinel. EXTRA_STATE_RINGING, the attacker checks if the incoming call number matches the pre-set number using EXTRA_PHONE_NUMBER 1. If the incoming number aligns with the attacker's preset, a fake incoming call screen, embedded within the application, overlays the display, thereby executing the Display Overlay Attack. #### 5.2.3 Outgoing Call

Finally, if the user attempts to dial a number targeted by the attacker, Call Redirection is employed. The vishing application conducts this attack step-by-step, as described in Figure 6. First, when the user presses the dial button, the vishing application checks if the outgoing call event has started using getAction1. If the call state is ACTION_NEW_OUTGOING_CALL, the application retrieves the number stored in EXTRA_PHONE_NUMBER 2. Should this number match the attacker's target, the vishing application uses setResultData() to replace the dialed number with one designated by the attacker 3. Once the outgoing number is altered, the number displayed to the user also changes, necessitating the use of Display Overlay to re-display the originally dialed number. This re-display occurs when the phone state switches to EXTRA_STATE_OFFHOOK, overlaying a fake incoming call screen to mask the redirection, thereby preventing the user from detecting any manipulation. As a result, when we run these benchmarks alongside Sentinel, we observe that normal defense operations are maintained, demonstrating that Sentinel is effective at defending APIs used at API level 28 and below, as well as those at API level 29 and above. ### Comparative Analysis

We conducted a comparative evaluation of vishing defense applications registered on the Google Play Store against Sentinel using the benchmarking applications we developed, as outlined in Section 5.2. Additionally, to prevent false positives from approved applications exhibiting behavior similar to Display Overlay Attacks, we analyzed the top four most downloaded call screen theme applications to assess whether they were detected as vishing applications. For evaluation, we categorized detection outcomes as follows: detecting a approved application as benign was classified as a True Negative (TN), detecting a approved application as malicious behavior was classified as a False Negative (FN), detecting a benchmark application as malicious behavior was classified as a True Positive

Figure 5: Display Overlay Attack operation. Figure 6: Call Redirection Attack operation. (TP), and detecting a benchmark application as benign behavior was classified as a False Positive (FP). As shown in Table 4, most commercial applications available on the Google Play Store failed to detect the malicious behaviors employed by vishing applications. Some applications that identify these malicious behaviors provide warnings by displaying the incoming or outgoing phone number to the user through pop-up windows when call events occur. Additionally, certain applications compare the incoming phone number at the start of a call with the number displayed when the call transitions to the OFFHOOK state, alerting the user to any discrepancies. However, these approaches are generally limited, as they primarily provide indirect warnings to users or are confined to detecting specific malicious behaviors only.