Skip to content

Behavioral Protection

Jump to bottom
Emirhan Uçan edited this page Jul 25, 2026 · 6 revisions

Behavioral Protection

HydraDragonAV Mobile includes a comprehensive suite of runtime behavioral detectors that protect against UI-based attacks, automated abuse, and configuration tampering — all without root or accessibility-service overreach.

1. UI Hijacking / Clickjacking Protection

Detects and blocks automated UI manipulation attacks:

Attack Type Detection Method
Automated rapid clicks Detects inhumanly fast permission-granting click sequences
Notification spam floods Monitors notification frequency from individual apps
Repeated overlay/dialog abuse Flags apps that repeatedly draw overlays or system dialogs
StrandHogg (Task Hijacking) Monitors activity stack for task-hijacking patterns

When detected, the offending app's background process is killed and a system uninstall prompt is displayed.

2. Notification Spam Detection

Monitors notification frequency and patterns to identify adware and spam apps:

  • Tracks notification volume per app over time
  • Flags apps that exhibit adware-style notification behavior
  • Each detector is individually toggleable from Settings

3. Settings Self-Protection

HydraDragonAV Mobile hardens its own Settings UI against automated tampering:

  • Tapjacking prevention: Every toggle/button checks FLAG_WINDOW_IS_OBSCURED — if an overlay is detected, the tap is rejected.
  • Burst detection: An inhumanly fast burst of setting changes (the signature of a malicious accessibility service driving the UI) is detected, reverted, and blocked.
  • Result: Only the actual device owner can change protection settings.
  • FLAG_SECURE guard: Detects unauthorized removal of FLAG_SECURE (screen recording protection). An optional "Allow screen recording" Settings toggle lets the user intentionally disable FLAG_SECURE — when enabled, the guard stops polling and does NOT treat the removal as tampering.
┌──────────────────┐
│  User taps       │
│  a setting       │
└────────┬─────────┘
         │
    ┌────▼────┐
    │ Overlay │      Yes
    │ present?│─────────► REJECT
    └────┬────┘
         │ No
    ┌────▼────┐
    │ Burst   │      Yes
    │ pattern?│─────────► REVERT + BLOCK
    └────┬────┘
         │ No
    ┌────▼────┐
    │  ALLOW  │
    │  change │
    └─────────┘

4. Screen Recording & Capture

HydraDragonAV Mobile has two separate subsystems related to screen capture — a prevention layer (FLAG_SECURE guard) and a detection layer (Zero Trust OCR scanning). Each has its own Settings toggle.

4.1 Screen Recording Guard (Prevention)

The app applies FLAG_SECURE to its own windows, preventing external apps (screen recorders, remote-support tools, casting) from capturing the UI. This is enforced by SecureWindowGuard:

Feature Detail
Default Screen recording is allowed (disable_secure_flag = true)
Toggle Settings → Allow screen recording (disable_secure_flag) — off by default in earlier versions, now on by default
Master switch Settings → Screen recording protection (behavior_detect_screen_security) — enables/disables the entire FLAG_SECURE subsystem
Tamper detection Every 2 seconds, SecureWindowGuard checks that FLAG_SECURE is still set. If removed without the user toggling "Allow screen recording" to ON, it fires onSecureFlagLost() (finishes the activity with a warning). This defends against Frida/Xposed hooks that remove FLAG_SECURE at runtime.
Show Taps defense The guard also warns if "Show taps" developer option is enabled, as it can leak tap positions through FLAG_SECURE. 
                        ┌──────────────────────────┐
                        │  Window created           │
                        │  onCreate()               │
                        └────────┬─────────────────┘
                                 │
                    ┌────────────▼────────────┐
                    │ disable_secure_flag     │
                    │ = true? (default)       │
                    └────────────┬────────────┘
                    ┌────────────┼────────────────┐
                    │ Yes        │ No              │
                    │ (default)  │                 │
              ┌─────▼─────┐    ┌─▼──────────────┐
              │ FLAG_SECURE│    │ SCREEN_SECURITY│
              │  NOT set   │    │  enabled?      │
              └───────────┘    └─┬──────────────┘
                            ┌────┴────┐
                            │ Yes     │ No
                      ┌─────▼──┐  ┌──▼──────┐
                      │ Apply  │  │  No     │
                      │ SECURE │  │ SECURE  │
                      └────────┘  └─────────┘

4.2 Zero Trust Screen OCR (Detection)

The app can actively capture screen frames and scan them for threats using on-device ML Kit OCR:

  • Service: ScreenCaptureService — a MediaProjection-based foreground service
  • Rate: Captures a frame every 4 seconds
  • OCR: ML Kit text recognition (Latin script model) — no network calls, fully on-device
  • Scanning: Recognized text is fed to:
    • NativeScanner.scanText() — immediate YARA-X matching against the hydradragon.screen_text module
    • NetworkObservations.addScreenText() — stored for future APK scan correlation
  • Toggle: Settings → Zero Trust screen scanning (screen_ocr, default false)
  • Consent: Requires per-session user consent via MediaProjectionManager.createScreenCaptureIntent()
  • Android 14+: Declares FOREGROUND_SERVICE_MEDIA_PROJECTION permission and foregroundServiceType="mediaProjection" 
┌──────────────────┐     capture frame     ┌──────────────────┐
│  Screen          │ ────────────────────► │ ScreenCapture    │
│  (any app)       │     every 4s         │ Service          │
└──────────────────┘                      └────────┬─────────┘
                                                   │
                                            ┌──────▼──────┐
                                            │ ML Kit OCR  │
                                            │ (Latin)      │
                                            └──────┬──────┘
                                                   │
                                            ┌──────▼──────┐
                                            │ Recognized  │
                                            │ text        │
                                            └──────┬──────┘
                                                   │
                           ┌───────────────────────┼───────────────┐
                           │                       │               │
                    ┌──────▼──────┐         ┌──────▼──────┐
                    │ YARA-X scan │         │ NetworkObs  │
                    │ (immediate) │         │ (store for  │
                    └─────────────┘         │ future)     │
                                            └─────────────┘

4.3 YARA-X Integration

The Rust native scanner (hydradragonandroid/src/lib.rs) feeds OCR text into scans as "screen_text" module metadata. YARA-X rules can match against on-screen text using:

import "hydradragon"

rule detected_scam_text {
    condition:
        hydradragon.screen_text contains "bank account"
}

4.4 Settings & Defaults

Setting Key Default Description
Allow screen recording disable_secure_flag true When ON, FLAG_SECURE is cleared — external screen recorders can capture the app's UI
Screen recording protection behavior_detect_screen_security true Master toggle for the entire FLAG_SECURE + tamper detection subsystem
Zero Trust screen scanning screen_ocr false When ON, starts ScreenCaptureService to periodically OCR the screen for threat detection

5. Behavioral Detection Suite (Runtime)

A dedicated set of runtime detectors, each individually toggleable from Settings:

Detector Function
UI/Notification Spam Identifies adware-style apps with aggressive notification behavior
Device Rooted Mid-Session Monitors for root access appearing after app installation
Permission+DNS Risk Score Combines permission analysis with DNS query patterns for risk scoring
Ransomware Behavior Active file I/O + screen interaction pattern analysis

Every hit immediately:

  1. Kills the offending app's background process (where possible)
  2. Pops the system uninstall prompt

6. Bloatware Cleaner

Background cleanup tool for removing pre-installed bloatware and suspicious apps, integrated into the Settings UI.

7. Launcher Change Detection

Detects when a third-party app takes over as the default home/launcher — a common persistence and click-fraud technique.

  • At the start of every scanAllApps() sweep, resolves Intent.CATEGORY_HOME to find the current default launcher
  • Compares with the previously observed launcher package
  • If changed, emits a LAUNCHER_CHANGE behavioral signal via HipsMonitor
  • Non-system apps replacing the launcher are flagged as suspicious
  • The signal feeds the hydradragon.launcher_change(package_re) YARA-X rule condition
  • Static DEX analysis also scans for launcher-hijacking API calls (clearPackagePreferredActivities, addPreferredActivity, createRequestRoleIntent) and includes them in auto-generated rules

8. Self-Protection & Root Detection

  • Device Admin tamper resistance: Prevents unauthorized deactivation of Device Admin
  • Rooted device detection: Refuses to run on rooted devices (RootCheck)
  • Debug mode warning: Alerts when USB/wireless debugging is left on (DebugModeCheck)

See Also

Clone this wiki locally