Skip to content

Architecture

Jump to bottom
Emirhan Uçan edited this page Aug 5, 2026 · 9 revisions

System Architecture

HydraDragonAV Mobile is designed as a multi-layered Android security suite operating across four core pillars: a persistent foreground service, an accessibility-based dynamic analysis engine, a MediaProjection-based OCR screen capture service, and a JNI-bridged native Rust scan engine.

Architecture Overview

┌─────────────────────────────────────────────────────────────────────────────┐
│                          ANDROID APPLICATION LAYER                          │
│                                                                             │
│  ┌──────────────────────────────────────────────────────────────────────┐  │
│  │                      GuardService (Foreground)                       │  │
│  │  • Watches Downloads folder in real time                             │  │
│  │  • Orchestrates scans, monitors threats 24/7                         │  │
│  │  • BroadcastReceiver intercepts new/updated APKs                     │  │
│  └──────────────────────────┬───────────────────────────────────────────┘  │
│                             │                                               │
│  ┌──────────────────────────▼───────────────────────────────────────────┐  │
│  │                     DynamicAnalysisService                           │  │
│  │  (Accessibility Service)                                             │  │
│  │  • Prevents automated UI hijacking (clickjacking)                    │  │
│  │  • Blocks overlay/notification-spam attacks                          │  │
│  │  • Scans on-screen text for ransomware/scam/phishing (20 languages)  │  │
│  └──────────────────────────┬───────────────────────────────────────────┘  │
│                             │                                               │
│  ┌──────────────────────────▼───────────────────────────────────────────┐  │
│  │                     ScreenCaptureService                             │  │
│  │  (MediaProjection-based OCR)                                         │  │
│  │  • Periodically captures foreground screen                           │  │
│  │  • Feeds extracted text into native threat scanner                   │  │
│  └──────────────────────────┬───────────────────────────────────────────┘  │
│                             │                                               │
│  ┌──────────────────────────▼───────────────────────────────────────────┐  │
│  │               ScanEngine + NativeScanner (Java/Rust)                 │  │
│  │  Java orchestration layer                    libhydradragonandroid.so │  │
│  │  • X.509 cert evaluation         ──JNI──►   • YARA-X + ClamAV        │  │
│  │  • SHA-256 hashing                            • Archive extraction    │  │
│  │  • Dangerous permission checks               • AXML manifest parsing │  │
│  │  • App install source check                  • ML anomaly scoring    │  │
│  └──────────────────────────────────────────────────────────────────────┘  │
│                                                                             │
│  ┌──────────────────────────┐    ┌─────────────────────────────────────┐   │
│  │     DnsVpnService        │    │   NetworkSecurityScanner/Monitor    │   │
│  │  (Local VPN / Web Shield)│    │   • Live connection tracking        │   │
│  │  • DNS lookup filtering  │    │   • Malicious IP/C2 flagging        │   │
│  │  • No traffic proxying   │    │   • MITM / TLS interception detect  │   │
│  │  • No decryption         │    │   • ARP spoofing detection          │   │
│  └──────────────────────────┘    └─────────────────────────────────────┘   │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

Four Core Pillars

1. GuardService

A persistent Foreground Service acting as the brain of the active defense system. It watches the Downloads folder in real time and orchestrates scans, monitoring threats 24/7.

2. DynamicAnalysisService

An Accessibility Service that:

  • Prevents automated UI hijacking (Clickjacking)
  • Blocks overlay/notification-spam attacks
  • Scans on-screen text for ransomware/SMS-scam/phishing wording in 20 languages

3. ScreenCaptureService

A MediaProjection-based OCR service that periodically captures and reads the foreground screen, feeding extracted text into the native scanner for live threat detection.

4. ScanEngine + NativeScanner

The Java orchestration layer and its Rust-native counterpart (libhydradragonandroid.so) — evaluating X.509 certificates, SHA-256 hashes, dangerous permissions, app install sources, YARA-X/ClamAV signatures, and ML anomaly scores.

The engine supports a scan type system (SCAN_TYPE_QUICK, SCAN_TYPE_FULL, SCAN_TYPE_ANTI_FP) with a pendingScanType mechanism: user-initiated scans can adopt an already-running background scan instead of starting a redundant one. Background scans run silently (no notifications) until the user opens the scan screen.

5. MalwareFoundActivity (Dialog Theme)

When a threat is detected during background scanning, instead of a full-screen activity that disrupts the user, a floating dialog overlay (Theme.HydraDragon.Dialog) is shown — translucent, no dimming, and no title bar, so the user sees the alert without losing context.

6. Scan Results UI

The scan screen displays an ACTIVE THREATS counter alongside the existing SCANNED and THREAT totals. Tapping a threat opens a rich dialog showing all detection reasons as a bulleted list with clickable VirusTotal URLs. Actions: Destroy (uninstall/delete), Ignore (whitelist), Ignore Signature (suppress specific detection name).

Data Flow: Threat Detection

  ┌──────────┐     ┌──────────────────┐     ┌───────────────────┐
  │ App      │     │   ScanEngine     │     │   NativeScanner   │
  │ Install/ │────►│   (Java)         │────►│   (Rust via JNI)  │
  │ File I/O │     │                  │     │                   │
  └──────────┘     │ • SHA-256 hash   │     │ • YARA-X matching │
                   │ • Permissions    │     │ • ClamAV sig scan │
                   │ • Permissions    │     │ • Archive extract │
                   │ • Install source │     │ • AXML parsing    │
                   │ • X.509 certs    │     │ • ML anomaly      │
                   └────────┬─────────┘     └────────┬──────────┘
                            │                        │
                            └──────────┬─────────────┘
                                       │
                                ┌──────▼──────┐
                                │   Verdict   │
                                │  Engine     │
                                └──────┬──────┘
                                       │
              ┌────────────────────────┼──────────────────────┐
              │                        │                      │
         ┌────▼────┐            ┌──────▼──────┐        ┌─────▼─────┐
         │Malicious │            │   Clean     │        │ Suspicious │
         │  Action  │            │   Allow     │        │   Alert   │
         └──────────┘            └─────────────┘        └───────────┘

Multi-Layer Detection Stack

Layer Technology Scope
Signature ClamAV Known malware signatures (Android-filtered)
Pattern YARA-X + hydradragon module Custom YARA rules with Android-specific modules
ML Anomaly MinHash/Jaccard benign whitelist (benign_db.rs) Content-based known-benign APK skip (64-permutation MinHash, Jaccard ≥ 0.85) — not a detector
ML Classifier Burn binary classifier (hydradragonml) 20K-token Embedding + vocab.json-mapped tokenizer + mean-pool fused with 11 corpus-percentile-normalized engine features → MLP → sigmoid scoring every APK (0.0–1.0); malicious ≥ 0.95, suspicious ≥ 0.90
AIEngine Logistic Regression (Java) DEX-level obfuscation/behavioral corroboration scoring (applied only when native engine corroborates)
NSRL Whitelist Binary-fuse XOR filter + CSV Known-good hash whitelisting
URL Scanner XOR filters Malicious/phishing URL extraction and checking
Network VpnService + live monitor DNS filtering, C2 IP blocking, MITM detection
Behavioral Accessibility + OCR Ransomware, smishing, clickjacking in real time
Emulation Unicorn Engine Native code sandbox execution for runtime string recovery

Zero-Trust Architecture

HydraDragonAV Mobile operates on a zero-trust principle:

  • All apps are suspicious until explicitly cleared by the NSRL whitelist and every detection engine.
  • Optional Zero-Trust Mode flags any app that "survives" all detectors without explicit clearance.
  • No component relies on ADB, root, or shell-privilege frameworks (see Why-HydraDragonAV-Mobile).
  • Settings are hardened against automated tampering via FLAG_WINDOW_IS_OBSCURED and burst-detection logic.

See Also

Clone this wiki locally