{"id":"https://openalex.org/W4412773368","doi":"https://doi.org/10.1007/s10207-025-01105-0","title":"PayScan: Detection and Security Analysis of Payment Libraries in Android Apps","display_name":"PayScan: Detection and Security Analysis of Payment Libraries in Android Apps","publication_year":2025,"publication_date":"2025-07-31","ids":{"openalex":"https://openalex.org/W4412773368","doi":"https://doi.org/10.1007/s10207-025-01105-0"},"language":"en","primary_location":{"id":"doi:10.1007/s10207-025-01105-0","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10207-025-01105-0","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10207-025-01105-0.pdf","source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10207-025-01105-0.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5018845377","display_name":"Fadi Mohsen","orcid":"https://orcid.org/0000-0003-3876-5781"},"institutions":[{"id":"https://openalex.org/I169381384","display_name":"University of Groningen","ror":"https://ror.org/012p63287","country_code":"NL","type":"education","lineage":["https://openalex.org/I169381384"]}],"countries":["NL"],"is_corresponding":true,"raw_author_name":"Fadi Mohsen","raw_affiliation_strings":["Bernoulli Institute for Mathematics, Computer Science and Artificial Intelligence, University of Groningen, 9747 AG, Groningen, Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Bernoulli Institute for Mathematics, Computer Science and Artificial Intelligence, University of Groningen, 9747 AG, Groningen, Netherlands","institution_ids":["https://openalex.org/I169381384"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067076363","display_name":"Manar Alohaly","orcid":"https://orcid.org/0000-0001-7460-2635"},"institutions":[{"id":"https://openalex.org/I106778892","display_name":"Princess Nourah bint Abdulrahman University","ror":"https://ror.org/05b0cyh02","country_code":"SA","type":"education","lineage":["https://openalex.org/I106778892"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Manar Alohaly","raw_affiliation_strings":["Information Systems Department, Princess Nourah Bint Abdulrahman University, Riyadh, Saudi Arabia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Information Systems Department, Princess Nourah Bint Abdulrahman University, Riyadh, Saudi Arabia","institution_ids":["https://openalex.org/I106778892"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008763262","display_name":"Usman Rauf","orcid":"https://orcid.org/0000-0003-3667-4974"},"institutions":[{"id":"https://openalex.org/I125924841","display_name":"Mercy University","ror":"https://ror.org/02s99ck98","country_code":"US","type":"education","lineage":["https://openalex.org/I125924841"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Usman Rauf","raw_affiliation_strings":["Department of Mathematics and Computer Science, Mercy University, Dobbs Ferry, NY, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Mathematics and Computer Science, Mercy University, Dobbs Ferry, NY, USA","institution_ids":["https://openalex.org/I125924841"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5119129086","display_name":"Dominic Therattil","orcid":null},"institutions":[{"id":"https://openalex.org/I169381384","display_name":"University of Groningen","ror":"https://ror.org/012p63287","country_code":"NL","type":"education","lineage":["https://openalex.org/I169381384"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Dominic Therattil","raw_affiliation_strings":["Bernoulli Institute for Mathematics, Computer Science and Artificial Intelligence, University of Groningen, 9747 AG, Groningen, Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Bernoulli Institute for Mathematics, Computer Science and Artificial Intelligence, University of Groningen, 9747 AG, Groningen, Netherlands","institution_ids":["https://openalex.org/I169381384"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5010363357","display_name":"Loran Oosterhaven","orcid":null},"institutions":[{"id":"https://openalex.org/I169381384","display_name":"University of Groningen","ror":"https://ror.org/012p63287","country_code":"NL","type":"education","lineage":["https://openalex.org/I169381384"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Loran Oosterhaven","raw_affiliation_strings":["Bernoulli Institute for Mathematics, Computer Science and Artificial Intelligence, University of Groningen, 9747 AG, Groningen, Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Bernoulli Institute for Mathematics, Computer Science and Artificial Intelligence, University of Groningen, 9747 AG, Groningen, Netherlands","institution_ids":["https://openalex.org/I169381384"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5018845377"],"corresponding_institution_ids":["https://openalex.org/I169381384"],"apc_list":{"value":2590,"currency":"EUR","value_usd":3190},"apc_paid":{"value":2590,"currency":"EUR","value_usd":3190},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.19907158,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"24","issue":"4","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9890999794006348,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9890999794006348,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.8165810108184814},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6921695470809937},{"id":"https://openalex.org/keywords/payment","display_name":"Payment","score":0.6512836217880249},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.61541748046875},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.5707881450653076},{"id":"https://openalex.org/keywords/security-analysis","display_name":"Security analysis","score":0.46272554993629456},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.4538099765777588},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.4344111680984497},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.29683300852775574}],"concepts":[{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.8165810108184814},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6921695470809937},{"id":"https://openalex.org/C145097563","wikidata":"https://www.wikidata.org/wiki/Q1148747","display_name":"Payment","level":2,"score":0.6512836217880249},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.61541748046875},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.5707881450653076},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.46272554993629456},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.4538099765777588},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.4344111680984497},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.29683300852775574}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1007/s10207-025-01105-0","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10207-025-01105-0","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10207-025-01105-0.pdf","source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"},{"id":"pmh:oai:pure.rug.nl:openaire_cris_publications/e551e665-9fc8-491c-a458-31489b92fd10","is_oa":true,"landing_page_url":"https://research.rug.nl/en/publications/e551e665-9fc8-491c-a458-31489b92fd10","pdf_url":null,"source":{"id":"https://openalex.org/S4306400420","display_name":"University of Groningen research database (University of Groningen / Centre for Information Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I169381384","host_organization_name":"University of Groningen","host_organization_lineage":["https://openalex.org/I169381384"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Mohsen, F, Alohaly, M, Rauf, U, Therattil, D & Oosterhaven, L 2025, 'PayScan : Detection and Security Analysis of Payment Libraries in Android Apps', International Journal of Information Security, vol. 24, no. 4, 189. https://doi.org/10.1007/s10207-025-01105-0","raw_type":"info:eu-repo/semantics/article"},{"id":"pmh:oai:pure.rug.nl:publications/e551e665-9fc8-491c-a458-31489b92fd10","is_oa":true,"landing_page_url":"https://hdl.handle.net/11370/e551e665-9fc8-491c-a458-31489b92fd10","pdf_url":null,"source":{"id":"https://openalex.org/S4306400420","display_name":"University of Groningen research database (University of Groningen / Centre for Information Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I169381384","host_organization_name":"University of Groningen","host_organization_lineage":["https://openalex.org/I169381384"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Mohsen, F, Alohaly, M, Rauf, U, Therattil, D & Oosterhaven, L 2025, 'PayScan : Detection and Security Analysis of Payment Libraries in Android Apps', International Journal of Information Security, vol. 24, no. 4, 189. https://doi.org/10.1007/s10207-025-01105-0","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1007/s10207-025-01105-0","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10207-025-01105-0","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10207-025-01105-0.pdf","source":{"id":"https://openalex.org/S164062316","display_name":"International Journal of Information Security","issn_l":"1615-5262","issn":["1615-5262","1615-5270"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Information Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4412773368.pdf","grobid_xml":"https://content.openalex.org/works/W4412773368.grobid-xml"},"referenced_works_count":24,"referenced_works":["https://openalex.org/W1604852208","https://openalex.org/W1972350641","https://openalex.org/W1997201541","https://openalex.org/W2059244804","https://openalex.org/W2060727319","https://openalex.org/W2087804676","https://openalex.org/W2400269587","https://openalex.org/W2441135008","https://openalex.org/W2532717356","https://openalex.org/W2607128324","https://openalex.org/W2764304644","https://openalex.org/W2765843494","https://openalex.org/W2792583723","https://openalex.org/W2907322364","https://openalex.org/W2912208904","https://openalex.org/W2945662577","https://openalex.org/W2962830343","https://openalex.org/W3009232367","https://openalex.org/W3044866801","https://openalex.org/W3091314653","https://openalex.org/W3091730649","https://openalex.org/W3122252170","https://openalex.org/W4205318208","https://openalex.org/W4237749166"],"related_works":["https://openalex.org/W2165251242","https://openalex.org/W1991580985","https://openalex.org/W3134738208","https://openalex.org/W2537703159","https://openalex.org/W589730254","https://openalex.org/W1974021515","https://openalex.org/W2829478414","https://openalex.org/W1017447425","https://openalex.org/W4387195303","https://openalex.org/W2400329213"],"abstract_inverted_index":{"Abstract":[0],"Third-party":[1],"payment":[2,37,80,98,154,168,179],"libraries":[3,38,81],"(TPLs)":[4],"are":[5],"widely":[6],"used":[7],"in":[8,39,152,157,166],"Android":[9,40,76],"applications":[10,95],"to":[11,52],"facilitate":[12],"in-app":[13],"transactions,":[14],"yet":[15],"their":[16,59,84],"security":[17,34,60,68,85,120,164],"implications":[18],"remain":[19],"largely":[20],"underexplored.":[21],"In":[22],"this":[23],"paper,":[24],"we":[25,110],"present":[26],"a":[27,72,185],"novel":[28],"approach":[29,143],"for":[30,188,195],"automated":[31],"detection":[32,142,189],"and":[33,48,55,82,86,135,146,170,190,198],"analysis":[35,47],"of":[36,74,94,174,177],"applications.":[41,118,159],"Our":[42,89],"tool,":[43],"PayScan,":[44],"employs":[45],"byte-pattern":[46],"heuristic":[49],"scanning":[50],"techniques":[51],"identify":[53],"TPLs":[54],"then":[56],"it":[57],"assesses":[58],"posture.":[61],"Additionally,":[62,109],"the":[63,172],"tool":[64,183],"integrates":[65],"three":[66],"independent":[67],"scanners.":[69],"We":[70,139],"analyzed":[71],"dataset":[73],"10,553":[75],"applications,":[77],"detecting":[78,153],"18":[79],"evaluating":[83],"privacy":[87],"risks.":[88],"findings":[90],"indicate":[91],"that":[92],"71.7%":[93],"use":[96],"outdated":[97],"libraries,":[99,155],"with":[100],"some":[101],"SDK":[102],"versions":[103],"being":[104],"over":[105,123],"four":[106],"years":[107],"old.":[108],"identified":[111],"397":[112],"private":[113],"key":[114],"leaks":[115],"across":[116],"212":[117],"The":[119,181],"scanners":[121],"detected":[122],"20,000":[124],"vulnerabilities,":[125],"including":[126,156],"critical":[127],"issues":[128],"such":[129],"as":[130],"SSL":[131],"misconfigurations,":[132],"WebView":[133],"XSS,":[134],"weak":[136],"cryptographic":[137],"implementations.":[138],"compare":[140],"our":[141],"against":[144],"LibScout":[145],"LibRadar,":[147],"demonstrating":[148],"its":[149],"practical":[150,193],"performance":[151],"obfuscated":[158],"This":[160],"study":[161],"reveals":[162],"important":[163],"risks":[165],"mobile":[167],"ecosystems":[169],"emphasizes":[171],"value":[173],"continued":[175],"monitoring":[176],"third-party":[178],"libraries.":[180],"proposed":[182],"offers":[184],"scalable":[186],"solution":[187],"analysis,":[191],"providing":[192],"utility":[194],"researchers,":[196],"developers,":[197],"auditors":[199],"focused":[200],"on":[201],"financial":[202],"application":[203],"security.":[204]},"counts_by_year":[],"updated_date":"2026-07-02T09:51:11.867554","created_date":"2025-10-10T00:00:00"}