Fraudulent Android app detection: a systematic framework based on multi-dimensional behavioral characteristics

Fraudulent Android applications have become the primary vector for online financial fraud, while existing detection methods remain ineffective against three adversarial techniques: (1) TLS 1.3 with certificate pinning, which blocks traffic interception; (2) environment-aware evasion, which disables malicious payloads in sandboxes; (3) rapid code obfuscation and repackaging, which shorten the effective window of static signatures. This paper presents a unified detection framework that counters these evasions through three dimensions. First, we design an evasion-aware dynamic sandbox that integrates kernel-level eBPF traffic interception with transparent TLS decryption. Second, we build a multi-dimensional behavioral graph (SDK-Permission-API) that captures hidden intent chains invisible to static analysis. Third, a time-decay risk propagation algorithm, termed RiskRank, is applied to a threat knowledge graph of 15,247 entities that jointly considers behavioral weight, graph association, and sample recency, improving the detection of fast-evolving fraud. We evaluate the framework on 2000 real-world Android applications, comprising 1000 fraudulent and 1000 benign samples, of which 68% are packed or obfuscated. Our system achieves 96.8% detection accuracy and 98.6% AUC-ROC, outperforming 6 state-of-the-art baselines by 8–16 percentage points. The system processes a sample in 128s on average, supporting 32 concurrent analyses for operational deployment.