VII. DISCUSSION
This section discusses limitations, possible improvements,
and other questions regarding our research. Our methodology
is based on dynamic analysis and may not be able to reveal all
links and ads in applications, thus leading to false negatives. A
partial mitigation of this issue may be possible by incorporating
other GUI exploration techniques as described in Section VIII
to improve coverage. We also inherit the limitations that are
generally applicable to GUI exploration techniques such as
getting past through login screens. We however believe that
such limitations do not affect the representativeness of our
study. Furthermore, we could bypass much of GUI exploration
by reading embedded links from applications statically and by
generating ad links directly by simulating interactions with ad
networks (this would require us to understand the protocols
between ad libraries and ad servers and is challenging to do).
This is part of our future work. Another source of possible
inaccuracies is the fact that we rely on external oracles such
as VirusTotal antiviruses and blacklists. It is likely that we
are missing scams and malware that these oracles missed.
Nonetheless, our research shows the benefit of doing analysis
at the app-web interfaces and any detection techniques may
complement our methodology.