  Although the use of pay-per-click mechanisms stimulates the prosperity of the
mobile advertisement network, fraudulent ad clicks result in huge financial
losses for advertisers. Extensive studies identify click fraud according to
click/traffic patterns based on dynamic analysis. However, in this study, we
identify a novel click fraud, named humanoid attack, which can circumvent
existing detection schemes by generating fraudulent clicks with similar
patterns to normal clicks. We implement the first tool ClickScanner to detect
humanoid attacks on Android apps based on static analysis and variational
AutoEncoder (VAE) with limited knowledge of fraudulent examples. We define
novel features to characterize the patterns of humanoid attacks in the apps'
bytecode level. ClickScanner builds a data dependency graph (DDG) based on
static analysis to extract these key features and form a feature vector. We
then propose a classification model only trained on benign datasets to overcome
the limited knowledge of humanoid attacks.
  We leverage ClickScanner to conduct the first large-scale measurement on app
markets (i.e.,120,000 apps from Google Play and Huawei AppGallery) and reveal
several unprecedented phenomena. First, even for the top-rated 20,000 apps,
ClickScanner still identifies 157 apps as fraudulent, which shows the
prevalence of humanoid attacks. Second, it is observed that the ad SDK-based
attack (i.e., the fraudulent codes are in the third-party ad SDKs) is now a
dominant attack approach. Third, the manner of attack is notably different
across apps of various categories and popularities. Finally, we notice there
are several existing variants of the humanoid attack. Additionally, our
measurements demonstrate the proposed ClickScanner is accurate and
time-efficient (i.e., the detection overhead is only 15.35% of those of
existing schemes).
