Payment-Guard: Detecting fraudulent in-app purchases in iOS system
Payment-Guard: Detecting fraudulent in-app purchases in iOS system
复制标题
Payment-Guard：检测iOS系统中的欺诈性应用内购买
DOI：
10.1016/j.neucom.2020.10.007
复制
发表时间：
2021
期刊：
影响因子：
6
通讯作者：
Chao Shen
中科院分区：
文献类型：
--
作者：
Yadong Zhou;Tianyi Yue;Xiaoming Liu;Lingling Tong;Zhihao Ding;Chao Shen
“应用内购买”作为一种成功的商业模式，逐渐被海量应用所采用。用户可以在不同类型的App中购买各种虚拟物品，例如下载电影或歌曲的许可证。App内购帮助App运营商获得了巨大的收入，同时也为用户提供了使用App的灵活性。最近，iOS应用程序遭受欺诈购买的攻击。攻击者利用iOS支付系统中的漏洞以零成本或低成本购买虚拟商品。更严重的是，肆无忌惮的攻击者公开招揽客户并提供购买服务，这给商业实体造成了巨大的经济损失。检测iOS应用程序中的欺诈性应用内购买，然后采取措施（例如，将商品出售）以最小化利润损失变得非常重要。本文提出了一个名为Payment-Guard的系统来实现这一目标，该系统从App账户行为、设备行为、IP行为和（App账户、设备、IP）的联合行为四个角度设计各种特征来表征购买行为，然后基于这些特征进行检测。我们基于从“王者荣誉”App收集的数据进行综合实验，该App是中国最知名的MOBA游戏之一，允许玩家为App账户充值虚拟货币。实验结果表明，Payment-Guard可以检测到92.2%的恶意应用内购买，误报率仅为2%。
As a successful business model, “in-app purchase” has been adopted by massive applications (Apps) gradually. Users can purchase various virtual goods in different kinds of Apps, such as the license to download movies or songs. In-app purchase helps App operators gain huge income, and meanwhile provides users with flexibility in using Apps. Recently, iOS Apps have suffered the attack of fraudulent purchase. Attackers leverage the vulnerabilities in iOS payment system to purchase virtual goods at zero or low cost. More seriously, unscrupulous attackers solicit customers publicly and provide purchasing services, which has caused huge financial loss to business entities. It becomes of great importance to detect the fraudulent in-app purchases in iOS Apps, and then take measures such as confiscating goods to minimize profit loss. In this paper, we propose a system called Payment-Guard to achieve this objective, which designs various features to characterize a purchase from four perspectives including App account behavior, device behavior, IP behavior and union behavior of (App account, device, IP), then conducts detection based on the features. We perform comprehensive experiments based on data collected from “Honor of Kings” App, which is one of the most famous MOBA games in China and allows players to recharge App accounts for virtual currency. Experimental results demonstrated that Payment-Guard can detect 92.2% malicious in-app purchases and with only 2% false positive rate.
登录
查看更多内容
DOI：
10.1016/j.procs.2015.04.201
发表时间：
2015
期刊：
Procedia Computer Science
影响因子：
--
作者：
Masoumeh Zareapoor;Pourya Shamsolmoali
通讯作者：
Masoumeh Zareapoor;Pourya Shamsolmoali
DOI：
10.1111/1467-9884.00122
发表时间：
1998-04
期刊：
The Statistician
影响因子：
--
作者：
D. Joanes;C. Gill
通讯作者：
D. Joanes;C. Gill
影响因子：
8.5
作者：
Bahnsen, Alejandro Correa;Aouada, Djamila;Ottersten, Bjoern
通讯作者：
Ottersten, Bjoern
DOI：
10.1080/00031305.2014.917055
发表时间：
2014
期刊：
The American statistician
影响因子：
--
作者：
Westfall PH
通讯作者：
Westfall PH
影响因子：
8.1
作者：
Igawa, Rodrigo Augusto;Barbon, Sylvio, Jr.;da Silva, Ivan Nunes
通讯作者：
da Silva, Ivan Nunes