Unveiling Collusion-Based Ad Attribution Laundering Fraud: Detection, Analysis, and Security Implications

In recent years, the growth of mobile advertising has been driven by in-app programmatic advertising and technologies like Real-Time Bidding (RTB). However, this growth has also led to an increase in ad fraud, such as click injection, background ad activity, etc. While existing studies have primarily concentrated on ad fraud within individual apps or devices, this paper introduces a new form of collusion-based ad fraud, named ad attribution laundering fraud (ALF). ALF involves multiple apps collaborating to deceive advertisers by misrepresenting the app where ads are displayed. The collusion-based approach allows lower-quality apps to exploit the reputable identities of seemingly legitimate apps. This deceives advertisers or ad networks into believing that the advertisements they place are reaching potentially valid end-users on the legitimate app. The seemingly legitimate ad events and ad attribution procedures employed by individual apps in such attacks can evade detection by existing tools.

To detect ALF, we design and implement the first detection framework, AlfScan. It overcomes two challenges to extract apps' identities from diverse and obfuscated apps using both static and dynamic analysis techniques, then cross-check the identities to identify ALF. We evaluate AlfScan on a 200-app ground truth dataset, and it achieves 92% precision and 92% recall. We use AlfScan to conduct a large-scale analysis on 91, 006 apps and identify 4, 515 unique fraudulent apps and 1, 483 fraudulent clusters, exposing patterns among fraudulent developers and revealing reliability * Guoxing Chen and Haojin Zhu are the corresponding authors.