{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T00:36:01Z","timestamp":1759970161904,"version":"build-2065373602"},"reference-count":42,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2025,1,7]],"date-time":"2025-01-07T00:00:00Z","timestamp":1736208000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Institute of Information &amp; Communications Technology Planning &amp; Evaluation (IITP)","award":["RS-2024-00398353"],"award-info":[{"award-number":["RS-2024-00398353"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Vishing, a blend of \u201cvoice\u201d and \u201cphishing\u201d, has evolved to include techniques like Call Redirection and Display Overlay Attacks, causing significant financial losses. Existing research has largely focused on user behavior and awareness, leaving gaps in addressing attacks originating from vishing applications. In this work, we present Ventinel, an Android-based defense system designed to detect these attacks without requiring OS modifications. Ventinel employs Optical Character Recognition (OCR) to compare phone numbers during calls, effectively preventing Call Redirection and Display Overlay Attacks. Additionally, it safeguards against Duplicated Contacts Attacks by cross-referencing call logs and SMS records. Ventinel achieves 100% detection accuracy, surpassing commercial applications, and operates with minimal data collection to ensure user privacy. We also describe malicious API behavior and demonstrate that the same behavior is possible for API levels 29 and higher. Furthermore, we analyze the limitations of existing solutions and propose new attack and defense strategies.<\/jats:p>","DOI":"10.3390\/fi17010024","type":"journal-article","created":{"date-parts":[[2025,1,7]],"date-time":"2025-01-07T07:42:19Z","timestamp":1736235739000},"page":"24","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Ventinel: Automated Detection of Android Vishing Apps Using Optical Character Recognition"],"prefix":"10.3390","volume":"17","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-8573-8820","authenticated-orcid":false,"given":"Daegyeom","family":"Kim","sequence":"first","affiliation":[{"name":"Graduate School of Software, Soongsil University, Seoul 06978, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-3651-1861","authenticated-orcid":false,"given":"Sehwan","family":"O","sequence":"additional","affiliation":[{"name":"Graduate School of Software, Soongsil University, Seoul 06978, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1759-9668","authenticated-orcid":false,"given":"Younghoon","family":"Ban","sequence":"additional","affiliation":[{"name":"Graduate School of Software, Soongsil University, Seoul 06978, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1489-0342","authenticated-orcid":false,"given":"Jungsoo","family":"Park","sequence":"additional","affiliation":[{"name":"Department of ICT Convergence Science, Kangnam University, Yongin 16979, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8310-6980","authenticated-orcid":false,"given":"Kyungho","family":"Joo","sequence":"additional","affiliation":[{"name":"Graduate School of Software, Soongsil University, Seoul 06978, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5344-5252","authenticated-orcid":false,"given":"Haehyun","family":"Cho","sequence":"additional","affiliation":[{"name":"Graduate School of Software, Soongsil University, Seoul 06978, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2025,1,7]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Kolandaisamy, R., Rajagopal, H., and Kolandaisamy, I. (2024, January 5\u20137). Emergence of Cybercrimes in Online Social Networks. Proceedings of the International Conference on Artificial Life and Robotics, Singapore.","DOI":"10.5954\/ICAROB.2024.OS18-11"},{"key":"ref_2","unstructured":"(2024, April 25). The Most Common Types of Cyber Crime. Available online: https:\/\/www.statista.com\/chart\/24593\/most-common-types-of-cyber-crime\/."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Hashmi, S.I., George, N., Saqib, E., Ali, F., Siddique, N., Kashif, S., Ali, S., Bajwa, N.U.H., and Javed, M. (2023, January 23\u201328). Training Users to Recognize Persuasion Techniques in Vishing Calls. Proceedings of the Extended Abstracts of the 2023 CHI Conference on Human Factors in Computing Systems, Hamburg, Germany.","DOI":"10.1145\/3544549.3585823"},{"key":"ref_4","unstructured":"Kim, J., Kim, J., Wi, S., Kim, Y., and Son, S. (July, January 27). HearMeOut: Detecting voice phishing activities in Android. Proceedings of the 20th Annual International Conference on Mobile Systems, Applications and Services, New York, NY, USA."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Das, S., and Ganguly, D. (2024). Protecting Your Assets: Effective Use of Cybersecurity Measures in Banking Industries. Next-Generation Cybersecurity: AI, ML, and Blockchain, Springer.","DOI":"10.1007\/978-981-97-1249-6_12"},{"key":"ref_6","unstructured":"Tu, H., Doup\u00e9, A., Zhao, Z., and Ahn, G.J. (2019, January 14\u201316). Users really do answer telephone scams. Proceedings of the 28th USENIX Security Symposium (USENIX Security 19), Santa Clara, CA, USA."},{"key":"ref_7","first-page":"297","article-title":"Phishing, SMiShing & Vishing: An assessment of threats against mobile devices","volume":"5","author":"Amanor","year":"2014","journal-title":"J. Emerg. Trends Comput. Inf. Sci."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Maggi, F. (July, January 29). Are the con artists back? A preliminary analysis of modern phone frauds. Proceedings of the 2010 10th IEEE International Conference on Computer and Information Technology, Bradford, UK.","DOI":"10.1109\/CIT.2010.156"},{"key":"ref_9","unstructured":"Figueiredo, J., Carvalho, A., Castro, D., Gon\u00e7alves, D., and Santos, N. (2024). On the Feasibility of Fully AI-automated Vishing Attacks. arXiv."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"235","DOI":"10.15388\/infedu.2016.12","article-title":"On mobile device security practices and training efficacy: An empirical study","volume":"15","author":"Chin","year":"2016","journal-title":"Inform. Educ."},{"key":"ref_11","unstructured":"(2024, October 07). Whowho. Available online: https:\/\/play.google.com\/store\/apps\/details?id=com.ktcs.whowho&hl."},{"key":"ref_12","unstructured":"(2024, October 07). Truecaller. Available online: https:\/\/play.google.com\/store\/apps\/details?id=com.truecaller&hl."},{"key":"ref_13","unstructured":"(2024, August 20). SafeVoice. Available online: https:\/\/play.google.com\/store\/apps\/details?id=co.safevoice&hl."},{"key":"ref_14","unstructured":"(2024, October 07). Hiya. Available online: https:\/\/play.google.com\/store\/apps\/details?id=com.webascender.callerid&hl."},{"key":"ref_15","unstructured":"(2024, October 07). Whoscall. Available online: https:\/\/play.google.com\/store\/apps\/details?id=gogolook.callgogolook2."},{"key":"ref_16","unstructured":"(2024, October 07). Phishingeyes. Available online: https:\/\/play.google.com\/store\/apps\/details?id=com.infinigru.lite.phishingeyes&hl."},{"key":"ref_17","unstructured":"(2024, October 07). CallApp. Available online: https:\/\/play.google.com\/store\/apps\/details?id=com.callapp.contacts."},{"key":"ref_18","unstructured":"(2024, October 07). Show Caller ID & Spam Blocker. Available online: https:\/\/play.google.com\/store\/apps\/details?id=com.truecaller.callerid.callername&hl."},{"key":"ref_19","unstructured":"(2024, October 07). SmartAntiPhishing. Available online: https:\/\/play.google.com\/store\/apps\/details?id=com.infinigru.sap.phishingeyes&hl."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"2091","DOI":"10.1109\/SURV.2013.032213.00009","article-title":"Phishing detection: A literature survey","volume":"15","author":"Khonji","year":"2013","journal-title":"IEEE Commun. Surv. Tutorials"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"103387","DOI":"10.1016\/j.cose.2023.103387","article-title":"Mitigation strategies against the phishing attacks: A systematic literature review","volume":"132","author":"Naqvi","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Wei, X., Gomez, L., Neamtiu, I., and Faloutsos, M. (2012, January 1\u20135). Malicious android applications in the enterprise: What do they do and how do we fix it?. Proceedings of the 2012 IEEE 28th International Conference on Data Engineering Workshops, Arlington, VA, USA.","DOI":"10.1109\/ICDEW.2012.81"},{"key":"ref_23","unstructured":"(2024, October 07). Android Developer PopupWindow. Available online: https:\/\/developer.android.com\/reference\/android\/widget\/PopupWindow."},{"key":"ref_24","unstructured":"(2024, October 07). Android Developer WindowManager. Available online: https:\/\/developer.android.com\/reference\/android\/view\/WindowManager."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Finley, J.R., Naaz, F., Goh, F.W., Finley, J.R., Naaz, F., and Goh, F.W. (2018). Results: Behaviors and experiences with internal and external memory. Memory and Technology: How We Use Information in the Brain and the World, Springer.","DOI":"10.1007\/978-3-319-99169-6"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Muhammad, Z., Anwar, Z., Javed, A.R., Saleem, B., Abbas, S., and Gadekallu, T.R. (2023). Smartphone Security and Privacy: A Survey on APTs, Sensor-Based Attacks, Side-Channel Attacks, Google Play Attacks, and Defenses. Technologies, 11.","DOI":"10.3390\/technologies11030076"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Hutchinson, S., Zhou, B., and Karabiyik, U. (2019, January 9\u201312). Are we really protected? An investigation into the play protect service. Proceedings of the 2019 IEEE International Conference on Big Data (Big Data), Los Angeles, CA, USA.","DOI":"10.1109\/BigData47090.2019.9006100"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Griffin, S.E., and Rackley, C.C. (2008, January 26\u201327). Vishing. Proceedings of the 5th Annual Conference on Information Security Curriculum Development, Kennesaw, Georgia.","DOI":"10.1145\/1456625.1456635"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"527","DOI":"10.1080\/17517575.2021.1896786","article-title":"A survey of phishing attack techniques, defence mechanisms and open research challenges","volume":"16","author":"Jain","year":"2022","journal-title":"Enterp. Inf. Syst."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"314","DOI":"10.1108\/ICS-07-2020-0113","article-title":"How social engineers use persuasion principles during vishing attacks","volume":"29","author":"Jones","year":"2020","journal-title":"Inf. Comput. Secur."},{"key":"ref_31","unstructured":"(2024, April 25). Phishing Activity Trends Report 4th Quarter 2023. Available online: https:\/\/apwg.org\/trendsreports\/."},{"key":"ref_32","unstructured":"(2024, October 07). Android Security Bulletins. Available online: https:\/\/source.android.com\/docs\/security\/bulletin\/asb-overview?hl."},{"key":"ref_33","unstructured":"(2024, October 07). All Android Releases. Available online: https:\/\/developer.android.com\/about\/versions."},{"key":"ref_34","unstructured":"(2024, October 07). Android Developers Android 9 Changes. Available online: https:\/\/developer.android.com\/about\/versions\/pie\/android-9.0-changes-all."},{"key":"ref_35","unstructured":"(2024, June 12). Google ML Kit. Available online: https:\/\/developers.google.com\/ml-kit."},{"key":"ref_36","unstructured":"(2024, August 20). Call Blocker. Available online: https:\/\/play.google.com\/store\/apps\/details?id=call.blacklist.blocker&hl."},{"key":"ref_37","unstructured":"(2024, November 01). Twilio. Available online: https:\/\/www.twilio.com\/en-us."},{"key":"ref_38","unstructured":"(2024, November 01). Hiya. Available online: https:\/\/www.hiya.com\/."},{"key":"ref_39","unstructured":"(2024, November 01). YouMail. Available online: https:\/\/www.youmail.com\/."},{"key":"ref_40","unstructured":"(2024, November 01). SK Telecom. Available online: https:\/\/www.sktelecom.com\/index_en.html."},{"key":"ref_41","unstructured":"(2024, November 01). LG Telecom. Available online: https:\/\/www.lguplus.com\/."},{"key":"ref_42","unstructured":"(2024, November 01). KT Telecom. Available online: https:\/\/www.kt.com\/."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/1\/24\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,8]],"date-time":"2025-10-08T10:24:28Z","timestamp":1759919068000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/1\/24"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,1,7]]},"references-count":42,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,1]]}},"alternative-id":["fi17010024"],"URL":"https:\/\/doi.org\/10.3390\/fi17010024","relation":{},"ISSN":["1999-5903"],"issn-type":[{"type":"electronic","value":"1999-5903"}],"subject":[],"published":{"date-parts":[[2025,1,7]]}}}