# Sentinel: Automated Detection of Android Vishing Apps Using Optical Character Recognition
## 4 Design
### Sentry of Ventinel
#### 4.1.1 Duplicated Contacts Verification
To initiate this process, Sentry first captures the screen at the beginning of an incoming or outgoing call and utilizes ML Kit [35], an OCR tool provided by Google, to extract the phone number displayed on the screen. This extraction process reads text that conforms to the phone number format from the top left to the right of the screen. Simultaneously, Sentry employs Android APIs to retrieve the outgoing or incoming number that the device is attempting to dial. For outgoing calls, it retrieves the number from theACTION_NEW_OUTGOING_CALL action, while for incoming calls, it uses getStringExtra(incomingNumber). Finally, Sentry compares the two phone numbers obtained during the call event to determine whether a Display Overlay has occurred and forwards the results to the Signaller. To facilitate screen capture, Sentinel sets the foreground service type to mediaProjection and requires the following permissions:

* READ_PHONE_STATE
* READ_CALL_LOGFor devices operating at API level 29 and above, an additional permission, READ_PHOCEN_NUMBER, is necessary. To implement the APIs that verify the outgoing number, the permissions detailed in Section 4.1.2 must be obtained. Moreover, to ensure Sentinel can run in the background together with other applications, it necessitates the FOREGROUND_SERVICE permission. ### 4.2. signaller of Sentinel

In Sentinel, the Signaller is responsible for notifying users of the malicious behaviors identified by the Sentry in real time. The Signaller generates a vibration on the device and displays a warning pop-up to alert the user of any detected Display Overlay or Call Redirection Attacks. To address Duplicated Contacts Attacks, the Signaller presents the user with a list of identified suspicious contacts and requests their consent to delete these entries. Upon receiving the user's approval, the Signaller proceeds with the deletion of the specified contacts. ## 5. Evaluation

In this section, we evaluate the overhead of Sentinel and present benchmarks to compare its detection capabilities against those of commercial applications. Furthermore, we perform a manual analysis of selected commercial applications to identify key factors affecting their detection rates. To gauge Sentinel's reliability from a user perspective, we also conducted a user study with 200 Android users. ### Evaluating Overhead

We evaluated the overhead to understand how Sentinel impacts the user's device when activated. Using a Galaxy Jean device, we compared CPU and memory usage with and without Sentinel running. When Sentinel was not running, CPU utilization averaged 14%, and memory usage was 74.2%. With Sentinel running, CPU utilization increased slightly to 15%, while memory usage remained unchanged at 74.2%. These results indicate that Sentinel does not cause any noticeable performance degradation on the device. Further details are provided in Figure 3.

### Benchmark with Ventinel

To evaluate Ventinel, we require vishing applications; however, we opt to use a benchmark with malicious behaviors, given the typically short lifecycle of vishing applications. Consequently, we develop a benchmark application at API level 28 and below and API level 29 and above that incorporates the following malicious behaviors: Display Overlay, Call Redirection, and Duplicated Contacts. #### 5.2.1 Idle

In an Idle state, vishing applications exploit Duplicated Contacts with procedures described in Figure 4. The attack begins while the device is in an IDLE state (i.e., PHONE_STATE_IDLE) with no incoming calls 1. The attacker searches for names in the contact list that match predefined target names (e.g., mother, mom, mum, mama, etc.) 2. If a target name is found, the attacker either saves their own phone number under the same name as the target contact or adds their number to the existing target contact 3. Consequently, when an incoming call event occurs, the attacker's number will appear under the target name. And if the user is not vigilant, the attack can go unnoticed.