When Ad Networks Misbehave: Understanding Risks of Semi-Drive-By Splash Ads

We investigate the mobile splash ads ecosystem, i.e., full-screen advertisements shown at app launch, where monetization relies on interaction signals that are difficult to verify end-to-end. This ad format is especially sensitive because it sits at the boundary between app startup and user navigation, where incidental touches and sensor-driven callbacks are common yet easy to misattribute as engagement. Prior work has largely framed mobile ad fraud as a publisher-side problem, while a small number of studies have attributed fraudulent operations to embedded ad libraries. Yet a distinct risk remains underexplored in splash advertising: ad SDKs control both how interaction signals are interpreted and how the resulting events are measured and reported, creating an opportunity to reinterpret ambiguous user or device signals as valid advertising interactions.

We uncover a previously less-known form of fraud at the adnetwork layer in which splash ads are triggered not by intentional user actions but by incidental or indirect interactions, a behavior we term semi-drive-by splash ads. By translating non-ad interactions into billable engagement events, ad networks can systematically inflate performance metrics, overcharge advertisers, and erode user trust while providing little or no real user interest.

To expose this behavior in the wild, we design AdHive, an automated honeypot-like analysis framework capable of inducing evasive splash-ad delivery and landing behaviors under realistic device conditions. Unlike traditional VM-based approaches, Ad-Hive reproduces human-like activity through LLM-generated usage traces and sensor dynamics, enabling execution paths that remain hidden under conventional analysis environments.

Our large-scale measurement across thousands of popular Android applications demonstrates that semi-drive-by splash ads are widespread and are often triggered by subtle environmental signals * Song Wu conducted this work while he was a remote intern in Xueqiang Wang's group.