Detect Redirect to the Malicious Web-Sites in ANDROID Devices
Volume 6, Issue 4, Spring 2026, Pages 12-24
https://doi.org/10.22034/apj.2026.2079995.1061
Seyed Mahmood Hashemi
Abstract Background and Objectives: Website clicks that redirect Android phone users to malicious websites with fake virus warnings or phishing attacks are increasing exponentially. Although a Uniform Resource Locator (URL) blacklist is considered as a suitable countermeasure for such attacks, it is difficult to efficiently identify malicious websites. To the best of our knowledge, no research has focused on detecting attacks that redirect Android phone users to malicious websites. Therefore, we propose a redirection detection method that focuses on the URL bar change interval of the Android-based Google Chrome browser.
Methods: The proposed method, which can be easily installed as an Android application, uses the Android Accessibility Service to detect unwanted redirects to malicious websites without collecting information about these websites in advance. This paper describes the details of the design, implementation, and evaluation results of the proposed application on a real Android device. We set threshold values for the number of times the URL bar changes and the elapsed time to detect redirects to malicious websites for the proposed method.
Finding: Based on the results, we investigated the causes of false positive detections of redirects to safe websites and proposed solutions to manage them. We also present threshold values that can minimize the false positive and negative rates, as well as the detection accuracy of the proposed method based on these threshold values. In addition, we present evaluation results based on access reports of real users participating in the WarpDrive project experiment, which show that the proposed method minimizes false positives and successfully detects most redirects to malicious websites.