发表机构
San Diego State University; The Hong Kong Polytechnic University; University of Central Florida（圣地亚哥州立大学; 香港理工大学; 中佛罗里达大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究揭示广告网络层半驱动式开屏广告欺诈，通过AdHive蜜罐框架实测数千应用，证实其普遍性并促成约400万元退款。
AI 中文摘要
我们研究了移动开屏广告生态系统，即应用启动时显示的全屏广告，其变现依赖于难以端到端验证的交互信号。这一场景尤为敏感，因为意外触摸和传感器驱动的回调很常见，却容易被误归因为用户参与。以往研究大多将移动广告欺诈视为发布商侧问题，而一些研究将欺诈操作归因于嵌入式广告库。然而，一个重要风险仍未得到充分探索：广告SDK控制着交互信号如何被解释、测量和报告，这为将模糊的用户或设备信号重新解释为有效广告交互提供了机会。我们揭示了广告网络层一种此前鲜为人知的欺诈形式，其中开屏广告并非由用户有意操作触发，而是由意外或间接交互触发，我们将其称为半驱动式开屏广告。通过将非广告交互转化为可计费的参与事件，广告网络可以虚增性能指标、过度收费广告主，并侵蚀用户信任。为了在真实环境中揭露这一行为，我们设计了AdHive，一种自动化蜜罐式分析框架，可在逼真的设备条件下诱导规避性开屏广告投放和落地行为。AdHive通过LLM生成的使用轨迹和传感器动态再现类人活动，从而实现在传统分析环境中隐藏的执行路径。我们对数千个流行Android应用的大规模测量表明，半驱动式开屏广告广泛存在，且常由细微信号（如轻微传感器变化）触发。我们进一步通过与一家中国大型广告主合作确认了现实影响，识别出多个参与此欺诈的广告网络，并促成约400万元人民币（约60万美元）的强制退款。
英文摘要
We investigate the mobile splash ads ecosystem, i.e., full-screen advertisements shown at app launch, where monetization relies on interaction signals that are difficult to verify end-to-end. This setting is especially sensitive because incidental touches and sensor-driven callbacks are common yet easy to misattribute as engagement. Prior work has largely framed mobile ad fraud as a publisher-side problem, while some studies attribute fraudulent operations to embedded ad libraries. Yet an important risk remains underexplored: ad SDKs control how interaction signals are interpreted, measured, and reported, creating an opportunity to reinterpret ambiguous user or device signals as valid advertising interactions. We uncover a previously less-known form of fraud at the ad-network layer in which splash ads are triggered not by intentional user actions but by incidental or indirect interactions, which we term semi-drive-by splash ads. By translating non-ad interactions into billable engagement events, ad networks can inflate performance metrics, overcharge advertisers, and erode user trust. To expose this behavior in the wild, we design AdHive, an automated honeypot-like analysis framework that induces evasive splash-ad delivery and landing behaviors under realistic device conditions. AdHive reproduces human-like activity through LLM-generated usage traces and sensor dynamics, enabling execution paths that remain hidden in conventional analysis environments. Our large-scale measurement across thousands of popular Android applications shows that semi-drive-by splash ads are widespread and are often triggered by subtle signals such as minor sensor variations. We further confirm real-world impact by working with one of China's largest advertisers, identifying multiple ad networks engaging in this fraud and leading to enforced repayments of about 4 million Yuan (approximately US$600,000).
CommentsThis paper has been accepted by the CCS2026b,it is going to be published
