# Sentinel: Automated Detection of Android Vishing Apps Using Optical Character Recognition
## 4 Design
### Sentry of Ventinel
#### 4.1.1 Duplicated Contacts Verification
Furthermore, Ventinel utilizes APIs that Google has mandated be disabled starting from API level 29. Consequently, if the minimum API level is set to 29 or higher, this feature will be completely deactivated. To address this limitation, it is essential to switch to an alternative API that gives the same results. ### Relay Station Attack

Ventinel is designed to protect against the malicious techniques employed by vishing applications. However, it is important to note that if a relay station alters the phone number, Ventinel will be unable to detect this modification. To mitigate this limitation, it is necessary to utilize the relay station detection APIs provided by services such as Twilio [37], Hiya [38], YouMail [39], and others. Since domestic services are not supported, close collaboration with telecommunications providers such as SK Telecom [40], LG Telecom [41], and KT Telecom [42] will be essential for effective implementation. ## 7 Conclusions

This study analyzes the APIs used by vishing applications and reveals that malicious behaviors, such as Call Redirection, Display Overlay and Duplicated Contacts are still be executed using specific APIs available at API level 29 and above. This finding confirms the vulnerabilities associated with APIs modifications and additions presented in the HearMeOut [4]. To address these issues, we propose Ventinel. We evaluated the detection accuracy of Ventinel using benchmarks from API level 28 and below, as well as those from API level 29 and above, achieving a high detection rate. Additionally, the application is designed to operate with minimal permissions at the app level, making it easy for users to install and use. Finally, user studies demonstrate that Ventinel is a robust tool capable of accurately detecting and warning against vishing applications. This research contributes to a better understanding of vishing and assists future studies in this domain. Conceptualization, D.K. ; methodology, D.K. ; software, D.K. and S.O. ; validation, D.K. ; formal analysis, D.K. ; investigation, D.K. ; resources, D.K. and S.O. ; data curation, D.K. ; writing--original draft preparation, D.K., S.O., Y.B., K.J. and H.C.; supervision, J.P., K.J. and H.C.; project administration, H.C. All authors have read and agreed to the published version of the manuscript. This work was supported by Institute of Information & Communications Technology Planning & Evaluation (IITP) grant funded by the Korean government (MSIT) (No. RS-2024-00398353, Development of Countermeasure Technologies for Generative AI Security Threats). Data are contained within the article. The authors declare no conflicts of interest. ## References

* (1) [PERSON]; [PERSON]; [PERSON] [PERSON] Emergence of Cybercrimes in Online Social Networks. In Proceedings of the International Conference on Artificial Life and Robotics, Singapore, 5-7 July 2024; ALife Robotics Co., Ltd.: Oita, Japan, 2024. The Most Common Types of Cyber Crime. Available online : [[https://www.statista.com/chart/24593/most-common-types-of-cyber-crime/](https://www.statista.com/chart/24593/most-common-types-of-cyber-crime/)]([https://www.statista.com/chart/24593/most-common-types-of-cyber-crime/](https://www.statista.com/chart/24593/most-common-types-of-cyber-crime/)) (accessed on 25 April 2024 ). * [PERSON] et al. (2023) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Training Users to Recognize Persuasion Techniques in Vishing Calls. In Proceedings of the Extended Abstracts of the 2023 CHI Conference on Human Factors in Computing Systems, Hamburg Germany, 23-28 April 2023; pp. 1-8. * [PERSON] et al. (2022) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] HearMeOut: Detecting voice phishing activities in Android. In Proceedings of the 20 th Annual International Conference on Mobile Systems, Applications and Services, New York, NY, USA, 27 June-1 July 2022; pp. 422-435. * [PERSON] and [PERSON] (2024) [PERSON]; [PERSON] Protecting Your Assets: Effective Use of Cybersecurity Measures in Banking Industries.