SecurityandPrivacyinMobileAdvertisingHaoChenUniversityofCalifornia,AdsaretheFinancialPillarofMobileComputingMostmobilesoftwareisfree.?Android?MostappsWheredoesrevenuecome??In-apppurchase?Ads?Users?Appdevelopers?Adproviders?Advertisers?pdevelopersadrevenuediversiondueto?Adproviders/advertisers:adfraudAnatomyofMobileAdTrafficenueDiversiongharmsappecosystemDevelopersloserevenueandincentivestoarketspollutedsearchresultsUsersdifficulttofindhighqualityappsappspersekets?>5,000clustersofclones?>44,000uniqueapps?Naivequestionytimeshasanappbeen?Betterquestionanypeopleuseaclonedapp?Counttheusersrunningeachapp.?Determinetheownershipofeachapp.?Classifyoriginalvs.plagiarizedapps.?Onthedevice?Ontheappserver?Onthenetworkappafficanalysiswithstaticanalysis?CaptureadtrafficExtractclientIDs?ExtractclientID?DeterminewhetheritisoriginalorclonecAnalysis?CollaboratedwithamajorUScellularprovider.?Captured2.6billionpacketsin12days.?Removedalluser-identifyinginformation.raudomaticallyviewadsandclickthemAppsthatautomatically“view”adsand“click”them?Designsystemforautomaticallydetectingadtraffic?Usesystemtodetectfraudandotheroraud?Impressionfraud:requestadswheninthebackground.?Clickfraud:clickonadswithoutuserinteraction.?Createanemulatorandinstalltheapp?Runappintheforegroundfor1minute?UseanIntenttomovetheappintothe?Runappinthebackgroundfor1minute?CaptureallnetworktrafficthroughoutithapptoensurealldetecteddulentyImpressionsandClicksh?Reverseengineeradlibrariestofindadrequest?UseURLstocountthenumberofimpressionsicks?Timeintensiveforthemanyadlibraries(80+)?LackcontextldionutomaticallyIdentifyImpressionsandClicksfyimpressionsusingmachinelearningbased?Requesttreeproperties?Queryparameters?HTTPpropertiessttreesandimpressions.wAppcloning?Market-scaleincrementalclonedetectionAdfraud?Includeproofsofuserviewingorclickingprovidedbytrustedsoftware.?Adsarecrucialforsustainingmobileappecosystem.?Adsinvolvesmultiplepartieswithcomp