COPS: A Compact On-device Pipeline for real-time Smishing detection

TL;DR

This work tackles the rising threat of mobile smishing and URL phishing by proposing COPS, a compact on-device pipeline that runs entirely locally, avoiding server interaction and preserving user privacy. Built on a disentangled beta-VAE architecture, COPS combines a Screen Understanding framework with a Smishing Detection Network and a Smishing Notifier to enable real-time alerts within the user’s app. It achieves high accuracy on open datasets ($98.15\%$ for smishing and $99.5\%$ for URL phishing), a small memory footprint ($3.46\mathrm{MB}$ model) and low latency suitable for mobile devices, supported by synthetic data generation to mitigate dataset imbalances. The paper also demonstrates on-device deployment on Android using TensorFlow Lite, ablation analyses showing the contributions of each component, and a real-time user study indicating practical effectiveness with minimal user disruption. Overall, COPS provides a privacy-preserving, efficient, and generalizable approach to real-time mobile phishing defense with strong empirical evidence across unseen data distributions.

Abstract

Smartphones have become indispensable in our daily lives and can do almost everything, from communication to online shopping. However, with the increased usage, cybercrime aimed at mobile devices is rocketing. Smishing attacks, in particular, have observed a significant upsurge in recent years. This problem is further exacerbated by the perpetrator creating new deceptive websites daily, with an average life cycle of under 15 hours. This renders the standard practice of keeping a database of malicious URLs ineffective. To this end, we propose a novel on-device pipeline: COPS that intelligently identifies features of fraudulent messages and URLs to alert the user in real-time. COPS is a lightweight pipeline with a detection module based on the Disentangled Variational Autoencoder of size 3.46MB for smishing and URL phishing detection, and we benchmark it on open datasets. We achieve an accuracy of 98.15% and 99.5%, respectively, for both tasks, with a false negative and false positive rate of a mere 0.037 and 0.015, outperforming previous works with the added advantage of ensuring real-time alerts on resource-constrained devices.

Figures (8)

• Figure 1: Smishing Detection: To the left is the existing system, and to the right is a system with the COPS pipeline
• Figure 2: COPS System Design: for a real-time Smishing detection
• Figure 3: The proposed architecture for COPS detection module
• Figure 4: On-device real-time Smishing detection flow for Android
• Figure 5: Precision-Recall curve showing comparative test results on Smishing with setup S4