Complementing Attestation with Behavioural Anomaly Detection in Mobile Applications

Android

Android offers a broader surface for both introspection and abuse. Key signals include:

• Device model, build fingerprint, and OS API level
• Touch interaction profiles and motion event patterns
• App installation source and signature consistency
• Sensor presence and live telemetry (e.g., accelerometer, gyroscope)

Due to Android's openness, attackers often use tools like Magisk, Xposed, or emulators such as Genymotion. The challenge lies in spotting subtle inconsistencies that reveal these tools are in play.

iOS

iOS provides a more closed environment with fewer observable data points:

• Jailbreak markers (Cydia, file system changes, unsigned binaries)
• Simulator detection (missing hardware sensors, deterministic timing)
• Network call behavior and UI interaction delays
• Limited motion entropy from touch or device movement

While attestation mechanisms (like DeviceCheck or App Attest) help validate the runtime, anomaly detection enables us to catch outlier behavior-particularly from simulated or jailbroken devices.

• Static sensors: Device sensors like the gyroscope or accelerometer remain inactive during app usage, which is highly unusual for real users. Human interaction naturally causes slight movements and sensor noise, its absence often points to automated environments like emulators or replays.

• Synthetic gestures: Taps, swipes, or scrolls exhibit unnaturally precise paths or timing such as millisecond-perfect delays or linear trajectories without variance. These patterns lack the randomness and fluidity of genuine touch input, making them strong indicators of bot behavior.

• Device inconsistency: The reported device metadata (e.g., model name, build fingerprint) doesn't match expected interaction behavior. For instance, a low-end device showing ultra-fast response times or high-touch accuracy may suggest spoofed device properties or simulated sessions.

• Session replays: The same interaction sequence is observed multiple times across different sessions, often with differing IPs, locations, or device IDs. This strongly points to session recording and replay attacks, typically used to exploit app logic or abuse transactional flows.

• Entropy gaps: Real human input contains natural variability in timing, gesture precision, and motion dynamics. Bots often fail to replicate this entropy, resulting in suspiciously uniform or deterministic input sequences that deviate from normal usage patterns.

These anomalies are contextual-some apps may see them more frequently than others depending on user demographics and typical usage.

• CAPTCHA Challenge

  Prompt the user with an in-app CAPTCHA (visual or native) to confirm human interaction in cases of medium-confidence anomalies.

• Trigger Attestation

  Enforce a mobile attestation process for the flagged session to revalidate device authenticity and runtime environment.

• Server-Side Rate Limiting

  Apply backend rate controls based on session or user identity to throttle anomalous traffic and contain potential abuse.

These responses are adaptive and configurable, giving application owners control over enforcement without affecting normal user experience.