Skip to content

Behavioral Protection

Jump to bottom
Emirhan Uçan edited this page Jul 28, 2026 · 6 revisions

Behavioral Protection

HydraDragonAV Mobile includes a comprehensive suite of runtime behavioral detectors that protect against UI-based attacks, automated abuse, and configuration tampering — all without root or accessibility-service overreach.

1. UI Hijacking / Clickjacking Protection

Detects and blocks automated UI manipulation attacks:

Attack Type Detection Method
Automated rapid clicks Detects inhumanly fast permission-granting click sequences
Notification spam floods Monitors notification frequency from individual apps
Repeated overlay/dialog abuse Flags apps that repeatedly draw overlays or system dialogs
StrandHogg (Task Hijacking) Monitors activity stack for task-hijacking patterns

When detected, the offending app's background process is killed and a system uninstall prompt is displayed.

2. Notification Spam Detection

Monitors notification frequency and patterns to identify adware and spam apps:

  • Tracks notification volume per app over time
  • Flags apps that exhibit adware-style notification behavior
  • Each detector is individually toggleable from Settings

3. Settings Self-Protection

HydraDragonAV Mobile hardens its own Settings UI against automated tampering:

  • Tapjacking prevention: Every toggle/button checks FLAG_WINDOW_IS_OBSCURED — if an overlay is detected, the tap is rejected.
  • Burst detection: An inhumanly fast burst of setting changes (the signature of a malicious accessibility service driving the UI) is detected, reverted, and blocked.
  • Result: Only the actual device owner can change protection settings.
  • FLAG_SECURE guard: Detects unauthorized removal of FLAG_SECURE (screen recording protection). An optional "Allow screen recording" Settings toggle lets the user intentionally disable FLAG_SECURE — when enabled, the guard stops polling and does NOT treat the removal as tampering.
┌──────────────────┐
│  User taps       │
│  a setting       │
└────────┬─────────┘
         │
    ┌────▼────┐
    │ Overlay │      Yes
    │ present?│─────────► REJECT
    └────┬────┘
         │ No
    ┌────▼────┐
    │ Burst   │      Yes
    │ pattern?│─────────► REVERT + BLOCK
    └────┬────┘
         │ No
    ┌────▼────┐
    │  ALLOW  │
    │  change │
    └─────────┘

4. Screen Recording & Capture

HydraDragonAV Mobile has two separate subsystems related to screen capture — a prevention layer (FLAG_SECURE guard) and a detection layer (Zero Trust OCR scanning). Each has its own Settings toggle.

4.1 Screen Recording Guard (Prevention)

The app applies FLAG_SECURE to its own windows, preventing external apps (screen recorders, remote-support tools, casting) from capturing the UI. This is enforced by SecureWindowGuard:

Feature Detail
Default Screen recording is allowed (disable_secure_flag = true)
Toggle Settings → Allow screen recording (disable_secure_flag) — off by default in earlier versions, now on by default
Master switch Settings → Screen recording protection (behavior_detect_screen_security) — enables/disables the entire FLAG_SECURE subsystem
Tamper detection Every 2 seconds, SecureWindowGuard checks that FLAG_SECURE is still set. If removed without the user toggling "Allow screen recording" to ON, it fires onSecureFlagLost() (finishes the activity with a warning). This defends against Frida/Xposed hooks that remove FLAG_SECURE at runtime.
Show Taps defense The guard also warns if "Show taps" developer option is enabled, as it can leak tap positions through FLAG_SECURE. 
                        ┌──────────────────────────┐
                        │  Window created           │
                        │  onCreate()               │
                        └────────┬─────────────────┘
                                 │
                    ┌────────────▼────────────┐
                    │ disable_secure_flag     │
                    │ = true? (default)       │
                    └────────────┬────────────┘
                    ┌────────────┼────────────────┐
                    │ Yes        │ No              │
                    │ (default)  │                 │
              ┌─────▼─────┐    ┌─▼──────────────┐
              │ FLAG_SECURE│    │ SCREEN_SECURITY│
              │  NOT set   │    │  enabled?      │
              └───────────┘    └─┬──────────────┘
                            ┌────┴────┐
                            │ Yes     │ No
                      ┌─────▼──┐  ┌──▼──────┐
                      │ Apply  │  │  No     │
                      │ SECURE │  │ SECURE  │
                      └────────┘  └─────────┘

4.1.1 File Create & Copy Detection

Every new file observed via MediaStore scanning triggers file-create tracking in RansomwareBehaviorGuard.onFileEvent():

  • FILE_CREATED: Each genuinely new file (not a rename match) gets a FILE_CREATED:path=...:size=... behavior flag. Bursts of ≥5 creates within 60s get FILE_CREATED_BURST:N.
  • FILE_COPY: When a new file appears AND FileReadEstimator has a recent read (within 30s) for the same foreground package with a size match within 15% tolerance, a FILE_COPY:size=N:src_size=N:src=PATH:conf=% flag is emitted — correlating the read source with the new destination file.
  • FILE_EXTENSION_ADDED: A new file whose name is an earlier known file with an extra suffix appended (report.pdf → report.pdf.xyz) emits FILE_EXTENSION_ADDED:<suffix>. This is the in-place-encryption shape, tracked independently of the ransomware burst gate.
  • FILE_EXTENSION_CHANGE: A new file that shares a stem with a known file but has a different extension (report.pdf → report.jpg) emits FILE_EXTENSION_CHANGE:<old>→<new>. Catches extension-swap behavior that a plain appended-suffix check would miss.

Both extension flags run unconditionally (no RANSOMWARE setting gate), like FILE_CREATED/FILE_COPY, and are counted into the file-created metric in HipsMonitor. They flow into the hydradragon YARA-X module as part of behavior_flags, so hydradragon.behavior_flagged(package_re) sees them.

Data sources:

  • FileReadEstimator.getRecentReadsByPackage(pkg) — returns recent read estimates for copy correlation
  • RansomwareBehaviorGuard.fileCreateBurst — tracks per-package create counts in a 60s sliding window

4.2 Zero Trust Screen OCR (Detection)

The app can actively capture screen frames and scan them for threats using on-device ML Kit OCR:

  • Service: ScreenCaptureService — a MediaProjection-based foreground service
  • Rate: Captures a frame every 4 seconds
  • OCR: ML Kit text recognition (Latin script model) — no network calls, fully on-device
  • Scanning: Recognized text is fed to:
    • NativeScanner.scanText() — immediate YARA-X matching against the hydradragon.screen_text module
    • NetworkObservations.addScreenText() — stored for future APK scan correlation
  • Toggle: Settings → Zero Trust screen scanning (screen_ocr, default false)
  • Consent: Requires per-session user consent via MediaProjectionManager.createScreenCaptureIntent()
  • Android 14+: Declares FOREGROUND_SERVICE_MEDIA_PROJECTION permission and foregroundServiceType="mediaProjection" 
┌──────────────────┐     capture frame     ┌──────────────────┐
│  Screen          │ ────────────────────► │ ScreenCapture    │
│  (any app)       │     every 4s         │ Service          │
└──────────────────┘                      └────────┬─────────┘
                                                   │
                                            ┌──────▼──────┐
                                            │ ML Kit OCR  │
                                            │ (Latin)      │
                                            └──────┬──────┘
                                                   │
                                            ┌──────▼──────┐
                                            │ Recognized  │
                                            │ text        │
                                            └──────┬──────┘
                                                   │
                           ┌───────────────────────┼───────────────┐
                           │                       │               │
                    ┌──────▼──────┐         ┌──────▼──────┐
                    │ YARA-X scan │         │ NetworkObs  │
                    │ (immediate) │         │ (store for  │
                    └─────────────┘         │ future)     │
                                            └─────────────┘

4.3 YARA-X Integration

The Rust native scanner (hydradragonandroid/src/lib.rs) feeds OCR text into scans as "screen_text" module metadata. YARA-X rules can match against on-screen text using:

import "hydradragon"

rule detected_scam_text {
    condition:
        hydradragon.screen_text contains "bank account"
}

4.4 Settings & Defaults

Setting Key Default Description
Allow screen recording disable_secure_flag true When ON, FLAG_SECURE is cleared — external screen recorders can capture the app's UI
Screen recording protection behavior_detect_screen_security true Master toggle for the entire FLAG_SECURE + tamper detection subsystem
Zero Trust screen scanning screen_ocr false When ON, starts ScreenCaptureService to periodically OCR the screen for threat detection

5. Behavioral Detection Suite (Runtime)

A dedicated set of runtime detectors, each individually toggleable from Settings:

Detector Toggle Key Function
UI/Notification Spam — Identifies adware-style apps with aggressive notification behavior
Device Rooted Mid-Session — Monitors for root access appearing after app installation
Permission+DNS Risk Score — Combines permission analysis with DNS query patterns for risk scoring
Ransomware Behavior — Active file I/O + screen interaction pattern analysis (see Ransomware-Defense)
Crypto-Miner Detection behavior_detect_miner Profiles /proc/<pid>/stat (CPU ticks) + /proc/<pid>/status (VmRSS) every 15s; flags if >20% CPU + >20MB VmRSS sustained for ≥45s or known miner process name matched. Feeds miner_events JSON to YARA-X. Threat type: PUA.
File Read Estimation behavior_detect_file_read_estimator Side-channel I/O profiling via /proc/<pid>/io read_bytes deltas matched against known file sizes (±10%, min 4KB). Scoring: size match (50%) + recency (30%) + cache ratio (15%) + per-process memory (5%). Reports FILE_READ behavior flags.
Wiper Detection behavior_detect_wiper In RansomwareBehaviorGuard.checkDeletions(): tracks known files via directory snapshots; if ≥10 files disappear in 60s + foreground app has >64MB per-process memory → WIPER_CONFIRMED flag + kill + uninstall.

Every hit immediately:

  1. Kills the offending app's background process (where possible)
  2. Pops the system uninstall prompt

6. Crypto-Miner Detection (Runtime)

MinerDetector profiles running processes via the /proc filesystem:

  • CPU: Reads /proc/<pid>/stat utime+stime ticks every 15s, computes CPU % from delta vs wall clock
  • Memory: Reads /proc/<pid>/status VmRSS (resident set size in kB) every 15s
  • Sustained threshold: >20% CPU AND >20MB VmRSS for ≥45s (3 consecutive samples)
  • Known names: Checks /proc/<pid>/cmdline and /proc/<pid>/comm against a hardcoded list of known miner process names (e.g. xmrig, minerd, ccminer, ethminer)
  • Reports structured data: Calls HipsMonitor.addMinerEvent(package, cpu, memory, knownName, isMalicious) — no raw flag strings
  • YARA-X integration: 4 module functions — miner_count(package_re), miner_cpu(package_re), miner_memory(package_re), miner_known_name(name_re) 
┌──────────────┐    /proc/<pid>/stat      ┌──────────────────┐
│ /proc/       │ ────────────────────────►│ MinerDetector    │
│ filesystem   │    /proc/<pid>/status    │ (15s interval)   │
│              │    /proc/<pid>/cmdline   └────────┬─────────┘
└──────────────┘                                   │
                                          ┌────────▼────────┐
                                          │ >20% CPU +      │
                                          │ >20MB VmRSS     │
                                          │ for ≥45s?       │
                                          └────────┬────────┘
                                                   │ Yes
                                          ┌────────▼────────┐
                                          │ HipsMonitor     │
                                          │ addMinerEvent() │
                                          └────────┬────────┘
                                                   │
                                          ┌────────▼────────┐
                                          │ YARA-X rules    │
                                          │ miner_count()   │
                                          │ miner_cpu()     │
                                          └─────────────────┘

7. File Read Estimation (Side-Channel I/O Profiling)

FileReadEstimator estimates which files a process is reading without hooking file I/O:

  • /proc/<pid>/io read_bytes samples every 30s
  • Computes delta between consecutive samples
  • Matches delta against known file sizes (±10% tolerance, minimum 4KB)
  • Best match (size + recency + cache ratio + per-process memory) → FILE_READ:pid=N:size=S:file=PATH:conf=%:cache=% behavior flag
  • Guarded by BehaviorDetectionSettings.FILE_READ_ESTIMATOR toggle

8. Wiper Detection

In RansomwareBehaviorGuard.checkDeletions():

  • Maintains directory snapshots (knownNamesByDir) of observed directories
  • On each check cycle (30s), rescans directories and compares actual files against snapshots
  • Tracks deletions per app in deletionsByPackage
  • If ≥10 files disappeared in 60s + foreground app has >64MB per-process memory → WIPER_CONFIRMED flag
  • Response: BehaviorResponse.killAndPromptUninstall
  • Guarded by BehaviorDetectionSettings.WIPER toggle

9. Behavior Graph UI

Per-app and device-level behavior visualization via BehaviorGraphFragment:

  • Radar chart: 8-axis spider/radar chart (BehaviorRadarChart Canvas custom View) — Network, File Ops, Permissions, Malware, Wiper, System, Miner, Spam
  • Detail list: 18-field breakdown below the chart (behavior flags, file reads, miner events, r/w bytes, DNS queries, etc.)
  • Device-level: "Behavior Graph" button on DashboardFragment
  • Per-package: "Behavior Graph" button in ScanFragment threat click dialog
  • Data source: BehaviorGraphData model populated via HipsMonitor.collectBehaviorData()

10. Bloatware Cleaner

Background cleanup tool for removing pre-installed bloatware and suspicious apps, integrated into the Settings UI.

11. Launcher Change Detection

Detects when a third-party app takes over as the default home/launcher — a common persistence and click-fraud technique.

  • At the start of every scanAllApps() sweep, resolves Intent.CATEGORY_HOME to find the current default launcher
  • Compares with the previously observed launcher package
  • If changed, emits a LAUNCHER_CHANGE behavioral signal via HipsMonitor
  • Non-system apps replacing the launcher are flagged as suspicious
  • The signal feeds the hydradragon.launcher_change(package_re) YARA-X rule condition
  • Static DEX analysis also scans for launcher-hijacking API calls (clearPackagePreferredActivities, addPreferredActivity, createRequestRoleIntent) and includes them in auto-generated rules

12. Self-Protection & Root Detection

  • Device Admin tamper resistance: Prevents unauthorized deactivation of Device Admin
  • Rooted device detection: Refuses to run on rooted devices (RootCheck)
  • Debug mode warning: Alerts when USB/wireless debugging is left on (DebugModeCheck)

See Also

Clone this wiki locally