Islamic Azad University, Khodabandeh Branch, Zanjan Arman Process Journal (APJ) 2783-1361 6 4 2026 01 21 Detect Redirect to the Malicious Web-Sites in ANDROID Devices Detect Redirect to the Malicious Web-Sites in ANDROID Devices 12 24 735648 10.22034/apj.2026.2079995.1061 FA Seyed Mahmood Hashemi KAR Higher Educational Institute Journal Article 2025 12 05 Background and Objectives: Website clicks that redirect Android phone users to malicious ‎websites with fake virus warnings or phishing attacks are increasing exponentially. Although a ‎Uniform Resource Locator (URL) blacklist is considered as a suitable countermeasure for such ‎attacks, it is difficult to efficiently identify malicious websites. To the best of our knowledge, no ‎research has focused on detecting attacks that redirect Android phone users to malicious ‎websites. Therefore, we propose a redirection detection method that focuses on the URL bar ‎change interval of the Android-based Google Chrome browser.‎<br>Methods: The proposed method, which can be easily installed as an Android application, uses ‎the Android Accessibility Service to detect unwanted redirects to malicious websites without ‎collecting information about these websites in advance. This paper describes the details of the ‎design, implementation, and evaluation results of the proposed application on a real Android ‎device. We set threshold values for the number of times the URL bar changes and the elapsed ‎time to detect redirects to malicious websites for the proposed method.‎<br>Finding: Based on the results, we investigated the causes of false positive detections of ‎redirects to safe websites and proposed solutions to manage them. We also present threshold ‎values that can minimize the false positive and negative rates, as well as the detection accuracy ‎of the proposed method based on these threshold values. In addition, we present evaluation ‎results based on access reports of real users participating in the WarpDrive project experiment, ‎which show that the proposed method minimizes false positives and successfully detects most ‎redirects to malicious websites.‎ Background and Objectives: Website clicks that redirect Android phone users to malicious ‎websites with fake virus warnings or phishing attacks are increasing exponentially. Although a ‎Uniform Resource Locator (URL) blacklist is considered as a suitable countermeasure for such ‎attacks, it is difficult to efficiently identify malicious websites. To the best of our knowledge, no ‎research has focused on detecting attacks that redirect Android phone users to malicious ‎websites. Therefore, we propose a redirection detection method that focuses on the URL bar ‎change interval of the Android-based Google Chrome browser.‎<br>Methods: The proposed method, which can be easily installed as an Android application, uses ‎the Android Accessibility Service to detect unwanted redirects to malicious websites without ‎collecting information about these websites in advance. This paper describes the details of the ‎design, implementation, and evaluation results of the proposed application on a real Android ‎device. We set threshold values for the number of times the URL bar changes and the elapsed ‎time to detect redirects to malicious websites for the proposed method.‎<br>Finding: Based on the results, we investigated the causes of false positive detections of ‎redirects to safe websites and proposed solutions to manage them. We also present threshold ‎values that can minimize the false positive and negative rates, as well as the detection accuracy ‎of the proposed method based on these threshold values. In addition, we present evaluation ‎results based on access reports of real users participating in the WarpDrive project experiment, ‎which show that the proposed method minimizes false positives and successfully detects most ‎redirects to malicious websites.‎ https://www.armanprocessjournal.ir/article_735648_04f1c006f7340e0ddda52ab394945086.pdf