Runtime-Permission-Based Early Detection of Voice Phishing

Abstract

Voice phishing (vishing) has evolved from social-engineering phone scams into technically assisted attacks, where victims install malicious Android apps that intercept calls, harvest contacts/messages, and redirect victims into fraudulent conversations. Since such malware needs a cluster of dangerous permissions, install-time and runtime permission patterns offer a behavioural signature for early detection—before call interception begins. This paper studies early-stage vishing detection via Android permission and API-call analysis, using a general Android malware/benign dataset (4,464 apps: 2,533 malware, 1,931 benign; 327 binary features) instead of a vishing-specific corpus. Point-biserial correlation identifies 157 significant features (p < 0.1), including vishing-relevant permissions like SYSTEM_ALERT_WINDOW, READ_PHONE_STATE, SEND_SMS, and RECEIVE_SMS. Among five classifiers tested, Logistic Regression performs best (96.75% accuracy, 97.13% F1), followed by linear SVM (95.97%, 96.42%) and Random Forest (95.86%, 96.35%). A model using only 15 vishing-relevant permissions still achieves 89.25% accuracy and 90.91% F1, showing strong discriminative power even without vishing-specific labels—supporting a lightweight, on-device early-warning approach and motivating future work with vishing-specific data.

Introduction

This study proposes a machine learning–based early-warning system for detecting Android vishing (voice phishing) malware by analyzing Android permissions and sensitive API calls before malicious phone activity begins. Modern vishing combines social engineering, caller-ID spoofing, and Trojanized Android apps that steal SMS messages, OTPs, calls, and banking credentials after obtaining dangerous permissions.

The research identifies Privilege Escalation (Phase 2) of the three-phase vishing lifecycle—installation, permission escalation, and deceptive telephony—as the optimal detection point because it provides strong behavioral evidence before users are harmed. Unlike existing methods that either rely only on static permissions or detect attacks after malicious calls have started, the proposed approach combines install-time permissions, runtime permissions, and API-call features to improve early detection.

Using the Android_Malware_Benign dataset containing 4,464 Android applications and 327 permission/API-call features, the study applied point-biserial correlation to identify significant malware indicators. Permissions such as READ_PHONE_STATE, READ_SMS, RECEIVE_SMS, SEND_SMS, and SYSTEM_ALERT_WINDOW showed strong associations with malicious behavior.

Five machine learning models were evaluated. On the full feature set, Logistic Regression achieved the best performance with 96.75% accuracy and a 97.13% F1-score, closely followed by a linear SVM with 95.97% accuracy. A compact SVM trained only on 24 vishing-related permission features achieved 89.25% accuracy and a 90.91% F1-score, demonstrating that a lightweight permission-based detector can effectively identify potential threats while remaining suitable for on-device deployment.

Compared with existing approaches, the proposed framework offers a practical balance between early detection, deployment simplicity, and high accuracy without requiring Android OS modifications. The study suggests that such a system could serve as the foundation for an application like VishielDroid, providing users with timely warnings before malicious telephony attacks occur.

The study acknowledges several limitations, including the use of a general malware dataset rather than a vishing-specific dataset, the absence of explicit runtime permission timing information, lack of real-device evaluation, and inability to assess long-term robustness against evolving malware behavior. Future work should validate the approach using dedicated vishing datasets and live Android environments.

Conclusion

Early Vishing Detection using Android Permissions and API Calls This paper surveyed early vishing attack discovery by analysing an Android Permission and a sensitive API call set by understanding a simple, vital requirement;vishing malwares must first acquire a unique cluster of potentially harmful Android permissions when escalating to privileged access,prior to actual telephone abuse . By creating substitute to highly vishing-labelled data -the AndroidMalwareBenign 4,464 application(s) dataset;using 327 (i)binary permission, (ii)API call-relevant features- a point-biserial correlation technique produced 157 features that were highly discriminant;a resultant feature space for 5 binary classifiers was thus compared by respective accuracy scores. Logistic Regression, along with a linear-kernel SVM, obtained the highest total-test accuracy results (96.75%, 95.97%) ;alternately, an effective, compact domain motivated features -such as a set of only 15 permission identifiers deemed morevishing-aware -still produced an 89.25% accuracy rate, and 90.91% for accuracy, even in the total lack ofvishing-specifically trained labels. From this evidence, permission-related signal remained useful enough to allow distinctions against new malwares beyond a strictly defined application collection. The results support building an lightweight, on device early warning and prevention application similar to our proposal of VishielDroid. Such application focuses its efforts on the permission granting process, and not on the call handling itself. Future work should focus on obtaining access to vishing-labelled ground-truth to evaluate our vishing-relevant portion of the malware dataset against a vishing-target, instead of using a generic malware label, and on providing explicit timestamps for runtime permission calls, in order to use request ordering and clustering to effectively model it, instead of only relying on static binary evidence to approximate it. Other directions we plan to take are modelling sequential data, i.e. Recurrent- or attention-networks, once timestamp-based data is available, measure resource utilisation and inference-latency on actual Android-devices of different OS version, assessing accuracy under different levels of class-imbalance and samples of different timing to observe concept-drift, and applying explainability methods like SHAP/LIME, which generate easily-intelligible explanation for non-experts about detection results. In future we plan to extend the feature set with runtime-relevant telephony signals, which may include attempt to redirect calls or utilize accessibility services to close the discrepancy in performance in comparison to other works that developed vishing detection systems with vishing only-target and claimed near-100% accuracy[Citation. .

References

[1] Kim, J., Kim, J., Wi, S., Kim, Y., & Son, S. (2022). HearMeOut: Detecting voice phishing activities in Android. In Proceedings of the 20th Annual International Conference on Mobile Systems, Applications and Services, pp. 289-301. [2] Lee, C., Kim, B., & Kim, H. (2025). The silence of the phishers: Early-stage voice phishing detection with runtime permission requests. Computers & Security, 152, 104364. [3] Song, J., Kim, H., & Gkelias, A. (2014). iVisher: Real-time detection of caller ID spoofing. ETRI Journal, 36(5), 865-875. [4] Sahin, M., Francillon, A., Gupta, P., & Ahamad, M. (2017). SoK: Fraud in telephony networks. In Proceedings of the 2nd European Symposium on Security and Privacy, pp. 235-250. [5] Wu, Y., Li, X., Zou, D., Yang, W., Zhang, X., & Jin, H. (2019). MalScan: Fast market-wide mobile malware scanning by social-network centrality analysis. In Proceedings of the 34th IEEE/ACM International Conference on Automated Software Engineering, pp. 139-150. [6] Li, H., Zhou, S., Yuan, W., Luo, X., Gao, C., & Chen, S. (2021). Robust Android malware detection against adversarial example attacks. In Proceedings of the 30th International Conference on World Wide Web, pp. 3603-3612. [7] Singh, A., Tanha, M., Girdhar, Y., & Hunter, A. (2024). Interpretable Android malware detection based on dynamic analysis. In Proceedings of the 10th International Conference on Information Systems Security and Privacy. [8] Li, J., Sun, L., Yan, Q., Li, Z., Srisa-An, W., & Ye, H. (2018). Significant permission identification for machine-learning-based Android malware detection. IEEE Transactions on Industrial Informatics, 14(7), 3216-3225. [9] Onwuzurike, L., Mariconti, E., Andriotis, P., Cristofaro, E. D., Ross, G., & Stringhini, G. (2019). MaMaDroid: Detecting Android malware by building Markov chains of behavioral models (Extended version). ACM Transactions on Privacy and Security, 22(2), 1-34. [10] Kouliaridis, V., Kambourakis, G., & Peng, T. (2020). Feature importance in Android malware detection. In Proceedings of the 19th International Conference on Trust, Security and Privacy in Computing and Communications. [11] Pandit, S., Perdisci, R., & Ahamad, M. (2018). Towards measuring the effectiveness of telephony blacklists. In Proceedings of the 25th Annual Network and Distributed System Security Symposium. [12] Tu, H., Doupé, A., Zhao, Z., & Ahn, G.-J. (2019). Users really do answer telephone scams. In Proceedings of the 28th USENIX Security Symposium, pp. 1327-1344. [13] Nahapetyan, A., Prasad, S., Childs, K., Oest, A., Ladwig, Y., Kapravelos, A., & Reaves, B. (2024). On SMS phishing tactics and infrastructure. In Proceedings of the 45th IEEE Symposium on Security and Privacy. [14] Android Developers. (2024). Android 6.0 changes. Retrieved from https://developer.android.com/about/versions/marshmallow/android-6.0-changes [15] Pardeshi, A. (2025). Early stage voice phishing detection with runtime permission request (Project Stage-I Report). Deogiri Institute of Engineering and Management Studies, Dr. Babasaheb Ambedkar Technological University, Lonere-Raigad.

Copyright

Copyright © 2026 Ms. Aayushi Pardeshi, Ms. Rucha R. Galgali, Mr. Akshatsingh Pardeshi. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.