Skip to content

AI ML Models

Jump to bottom
Emirhan Uçan edited this page Jul 17, 2026 · 13 revisions

AI / ML Models

HydraDragonAV Mobile employs an ONNX-based binary classifier for APK malware detection, plus a Java-side logistic regression heuristic (AIEngine).

1. ONNX Binary Classifier (hydradragonml)

Technique

APK feature extraction → 256-dimensional vector → tract-onnx inference:

  1. Feature extraction (features.rs): harvests printable ASCII + UTF-16LE strings from AndroidManifest.xml, resources.arsc, all classes*.dex, and META-INF/*. Produces a 256-d feature-hashed, L2-normalized vector.
  2. ONNX model (model.onnx): a neural network trained offline on malware + benign APK corpora. Returns a confidence score (0.0–1.0).
  3. Threshold: default 0.5; configurable via Model::set_threshold().

Implementation

hydradragonml/
├── src/
│   ├── lib.rs           # Model loading + inference (tract-onnx)
│   ├── features.rs      # APK feature extraction (256-d vector)
│   └── main.rs          # Dataset scanner CLI (hydradragonml-scan)
└── Cargo.toml

Dataset Scanner CLI

A standalone binary that batch-scans the entire dataset/ folder:

cargo run --release --bin hydradragonml-scan -- `
  --dataset ..\dataset\ `
  --model ..\app\src\main\assets\scan\model.onnx `
  --whitelist ..\app\src\main\assets\scan\whitelist.xf `
  --packages ..\app\src\main\assets\scan\whitelist_packages.db `
  --threshold 0.5

Scan pipeline per APK:

Step Check ML Skipped? Signature
1 NSRL hash whitelist (whitelist.xf) ❌ (stats only) NSRL.Whitelist
2 Package whitelist (whitelist_packages.db) ❌ (stats only) Package.Whitelist
3 ONNX model (model.onnx) ❌ ML.Benign / ML.Malware

Output includes per-file verdict, matching signatures, package name, MD5, and a summary with accuracy / precision / recall / F1 vs folder labels.

Strengths

  • Detects zero-day malware that shares no signatures with known threats
  • No training on the device — model is pre-trained offline
  • Low false positive rate when combined with NSRL whitelisting

2. AIEngine (Logistic Regression)

Technique

A lightweight logistic-regression classifier that operates on DEX-level features:

Feature Description
Obfuscation Score Reflection, string encryption, dynamic class loading
Dynamic Loading DexClassLoader, PathClassLoader usage patterns
API Usage Crypto (Cipher, SecretKey), sockets, Runtime.exec()
Adware SDKs Known ad/monetization SDK fingerprints
Dangerous Permissions Count and combination analysis

Scoring

The AIEngine produces a continuous score (0.0–1.0). Thresholds are configurable:

  • < 0.3: Clean
  • 0.3–0.7: Suspicious (further analysis triggered)
  • > 0.7: Malicious (immediate action)

See Also

Clone this wiki locally