# Sentinel: Automated Detection of Android Vishing Apps Using Optical Character Recognition
## 4 Design
### Sentry of Ventinel
#### 4.1.1 Duplicated Contacts Verification  
The Sentry module conducts a search for duplicate contacts within the contacts stored on the Android device while in IDLE. Any contacts identified as duplicates are forwarded to the Sigmaller module for further action. Vishing applications add or modify contacts without the victim's awareness, causing the attacker's number to appear on the incoming or outgoing call screen. Algorithm 1 is pseudocode that enables the Sentry of Ventinel to perform Duplicate Contact Verification. The Sentry accesses the complete contact list, SMS messages, and call logs from the Android device. To facilitate Sentry, the following permissions must be granted by the user explicitly:  
* READ_CONTACTS
* READ_SMS
* READ_CALL_LOG  
```
1:contacts\(\leftarrow\) List of existing Contacts
2:contactMap\(\leftarrow\) initialize empty hash table
3:forcontactincontactsdo
4:name\(\leftarrow\) name of contact
5:pNumList\(\leftarrow\) phone numbers of contact
6:contactMap\([name]\)\(\leftarrow\)pNumList
7:if already name in keythen
8: Add contactMap\([name]\) to pNumList
9:endif
10:endfor
11:dupMap\(\leftarrow\) initialize empty hash table
12:for each key, value in contactMapdo
13:if\(value\).length\(>1\)then
14:dupMap\([key]\)\(\leftarrow\)value
15:endif
16:endfor
17:historyList\(\leftarrow\) List of Recent Call and SMS history
18:whileList\(\leftarrow\) empty set
19:forhistory in historyListdo
20:pNum\(\leftarrow\) phone number in history
21: Add pNum to whiteList
22:endfor
23:for each key, value in dpMapdo
24:for number in value do
25:if number \(\in\) whiteListthen
26: Delete value in dpMap
27:endif
28:endforOnce these permissions are obtained, the Sentry identifies any contacts with the same name or multiple phone numbers associated with a single name as duplicates. Additionally, phone numbers that exist in recent call and text records are created as a whiteList, assuming that they are related to the user. The Sentry then removes these whitelisted numbers from the identified duplicates, generating a list of suspicious duplicate contacts, which is subsequently forwarded to the Signaller. #### 4.1.2 Call Redirection Verification

The Sentry is designed to detect Call Redirection Attacks that intercept calls initiated by vishing applications and to alert the victim accordingly. To accomplish this, it utilizes Android APIs to request and validate call-related information from the device initiating the call. As such, Sentry requires the following permissions:

* READ_PHONE_STATE
* READ_CALL_LOG

For devices operating at API level 29 and lower, an additional permission, PROCESS_OUTGOING_CALLS, is necessary, while devices operating at API level 29 and above require the permission READ_PHONE_NUMBER. When a phone number is entered and the dial button is pressed in Android dialing applications, the Operating System triggers theACTION_NEW_OUTGOING_CALL action and transmits EXTRA_PHONE_NUMBER, which contains the dialed number as an intent value. The Sentry requests this value and stores it in a designated variable for comparison against the phone number obtained when the call state transitions to EXTRA_STATE_OFFHOOK, as this value remains unaffected by any Call Redirection Attack. Subsequently, when the call state changes to EXTRA_STATE_OFFHOOK, the intent value is cleared, and the final dialed phone number is retrieved using getResultData(). The initially stored value (the intended phone number) is then compared with the final phone number received after dialing. The result of this comparison is forwarded to the Signaller. This approach is effective for detecting Call Redirection Attacks across both API levels 28 and below as well as 29 and above. #### 4.1.3 Display Overlay Verification

Algorithm 2 shows the pseudocode for Sentinel's Sentry to conduct Display Overlay Verification. To monitor for Display Overlay, Sentry compares the phone numbers displayed on the screen during incoming and outgoing calls with the actual phone numbers being dialed.