From UI to Code: Mobile Ads Detection via LLM-Unified Static-Dynamic Analysis

1. Problem Statement

Mobile advertisements are a primary revenue source for app developers but often degrade user experience through disruptive, unskippable, or malicious content (malvertising). Detecting these ads and verifying their regulatory compliance is challenging due to:

• Dynamic Content: Ads are fetched from remote servers and rendered dynamically, making static content-based detection ineffective.
• UI Diversity: Ads appear in diverse user interfaces (UIs) with varying layouts, making it difficult to locate them via general-purpose UI exploration.
• Inefficiency of Existing Methods:
  • Pure Dynamic Exploration: Wastes resources exploring paths that do not lead to ads and suffers from state explosion.
  • Pure Static Analysis: Often generates infeasible execution paths to reach specific UIs containing ads.
  • Content-Based Detection: Fails when ad content changes upon reloading the app.

The core challenge is pinpointing "ad widgets" (the specific UI components responsible for rendering ads) and navigating to them efficiently to trigger and analyze their behavior.

2. Methodology: ADWISE Framework

ADWISE proposes a novel framework that unifies Static Program Analysis with LLM-Guided Dynamic UI Exploration. It operates in two phases:

Phase 1: Static Ad Analysis (Offline)

Before runtime, ADWISE analyzes the app's code and UI layouts to identify candidate ad widgets and construct a navigation map.

• Ad Widget Identification: It performs a novel dataflow analysis to link UI widgets to their view classes, resource IDs, and method invocations. It applies inference rules to categorize widgets into three types:
  1. Adview Widgets: Specialized views from ad libraries (e.g., AdView).
  2. Popup Widgets: Standard views that invoke ad library APIs (e.g., InterstitialAd.show()).
  3. Native Widgets: Custom code that redirects users to external ads or app stores.
• Window Transition Graph (WTG) Construction: It builds a static graph representing possible UI transitions (Activities, Dialogs, Menus) to model cross-UI navigation paths.

Phase 2: Ad-Oriented UI Exploration (Runtime)

ADWISE casts UI exploration as a Grounded LLM Agent Loop. The agent navigates the app to trigger the candidate ad widgets identified in Phase 1.

• Three Complementary Guidance Signals: To steer the LLM toward ad widgets, the system provides:
  1. WTG-Based Guidance: Uses Dijkstra's algorithm on the static WTG to provide global shortest-path priors to target UIs.
  2. Semantic Guidance: Uses LLMs to summarize app metadata (category, description) to infer user intent and prioritize paths likely visited by target users (e.g., navigating to a playlist in a music app).
  3. Structural Guidance: Uses Retrieval-Augmented Generation (RAG) to retrieve similar UI layouts from a knowledge base, helping the LLM recognize recurring developer patterns for ad placement (e.g., "More Apps" menus).
• Grounded Reasoning & Verification: To prevent LLM hallucinations:
  • Action Reflection: After every step, the LLM compares pre- and post-action UI states to verify if the transition occurred. Failed actions are recorded to prune invalid paths.
  • UI State Verification: The system filters the UI hierarchy to remove non-clickable or obscured elements before presenting them to the LLM, reducing the action space.

3. Key Contributions

1. Unified Framework: ADWISE is the first approach to effectively unify static analysis (for identifying what to look for) with dynamic LLM exploration (for determining where to find it), bridging the gap between imprecise static paths and dynamic execution.
2. Novel Guidance Mechanisms: The introduction of three specific guidance signals (WTG, Semantic, Structural) allows the LLM to reason about both the app's specific functionality and generic ad placement patterns across the ecosystem.
3. Grounded Agent Design: The integration of action reflection and UI state verification significantly reduces hallucination, enabling the LLM to adapt to infeasible transitions and noisy UI states in real-time.
4. Comprehensive Regulation Detection: Unlike prior works focusing only on content, ADWISE detects violations across three dimensions: Placement (size/position), Interaction (unskippable/disruptive), and Content (malicious/deceptive).

4. Experimental Results

The framework was evaluated on 100 benchmark apps containing 271 ad widgets.

• Ad Widget Detection:
  • ADWISE achieved a 62.40% average detection rate.
  • It outperformed the state-of-the-art baseline (GoalExplorer) by 25.60% and the LLM-only baseline (Guardian) by 42.33%.
  • It detected 69.10% of Adview widgets, 58.69% of Popup widgets, and 51.13% of Native widgets.
• Efficiency:
  • ADWISE was the most efficient, with a Per-Widget Detection Latency (PWDL) of 10.00 seconds, making it 8.68% faster than the next best baseline (GoalExplorer).
• Regulation Violation Detection:
  • ADWISE identified 133 regulation violations, exceeding the best baseline by 34.34%.
  • It is the only academic approach capable of detecting violations in all three categories (Placement, Interaction, Content).
• Ablation Studies: Removing any of the three guidance signals significantly reduced performance, with Structural Guidance contributing the most to detection accuracy.

5. Significance

• Practical Impact: ADWISE provides a scalable solution for regulators and platforms to audit ad compliance, directly addressing issues like intrusive ads, malvertising, and deceptive practices.
• Research Advancement: It demonstrates how LLMs can serve as a "reasoning layer" to reconcile the limitations of static program analysis with the unpredictability of dynamic mobile environments.
• Real-World Validation: The authors successfully used ADWISE to identify actionable violations and filed bug reports with the Meta Bug Bounty Program, proving its utility in real-world security contexts.

In conclusion, ADWISE represents a significant leap forward in mobile ad analysis by moving beyond simple content matching to a holistic, code-aware, and semantically guided exploration strategy.