Behavioral Protection

HydraDragonAV Mobile includes a comprehensive suite of runtime behavioral detectors that protect against UI-based attacks, automated abuse, and configuration tampering — all without root or accessibility-service overreach.

1. UI Hijacking / Clickjacking Protection

Detects and blocks automated UI manipulation attacks:

Attack Type	Detection Method
Automated rapid clicks	Detects inhumanly fast permission-granting click sequences
Notification spam floods	Monitors notification frequency from individual apps
Repeated overlay/dialog abuse	Flags apps that repeatedly draw overlays or system dialogs
StrandHogg (Task Hijacking)	Monitors activity stack for task-hijacking patterns

When detected, the offending app's background process is killed and a system uninstall prompt is displayed.

2. Notification Spam Detection

Monitors notification frequency and patterns to identify adware and spam apps:

Tracks notification volume per app over time
Flags apps that exhibit adware-style notification behavior
Each detector is individually toggleable from Settings

3. Settings Self-Protection

HydraDragonAV Mobile hardens its own Settings UI against automated tampering:

Tapjacking prevention: Every toggle/button checks FLAG_WINDOW_IS_OBSCURED — if an overlay is detected, the tap is rejected.
Burst detection: An inhumanly fast burst of setting changes (the signature of a malicious accessibility service driving the UI) is detected, reverted, and blocked.
Result: Only the actual device owner can change protection settings.
FLAG_SECURE guard: Detects unauthorized removal of FLAG_SECURE (screen recording protection). An optional "Allow screen recording" Settings toggle lets the user intentionally disable FLAG_SECURE — when enabled, the guard stops polling and does NOT treat the removal as tampering.

┌──────────────────┐
│  User taps       │
│  a setting       │
└────────┬─────────┘
         │
    ┌────▼────┐
    │ Overlay │      Yes
    │ present?│─────────► REJECT
    └────┬────┘
         │ No
    ┌────▼────┐
    │ Burst   │      Yes
    │ pattern?│─────────► REVERT + BLOCK
    └────┬────┘
         │ No
    ┌────▼────┐
    │  ALLOW  │
    │  change │
    └─────────┘

4. Screen Recording & Capture

HydraDragonAV Mobile has two separate subsystems related to screen capture — a prevention layer (FLAG_SECURE guard) and a detection layer (Zero Trust OCR scanning). Each has its own Settings toggle.

4.1 Screen Recording Guard (Prevention)

The app applies FLAG_SECURE to its own windows, preventing external apps (screen recorders, remote-support tools, casting) from capturing the UI. This is enforced by SecureWindowGuard:

Feature	Detail
Default	Screen recording is allowed (`disable_secure_flag` = `true`)
Toggle	Settings → Allow screen recording (`disable_secure_flag`) — off by default in earlier versions, now on by default
Master switch	Settings → Screen recording protection (`behavior_detect_screen_security`) — enables/disables the entire FLAG_SECURE subsystem
Tamper detection	Every 2 seconds, `SecureWindowGuard` checks that `FLAG_SECURE` is still set. If removed without the user toggling "Allow screen recording" to ON, it fires `onSecureFlagLost()` (finishes the activity with a warning). This defends against Frida/Xposed hooks that remove FLAG_SECURE at runtime.
Show Taps defense	The guard also warns if "Show taps" developer option is enabled, as it can leak tap positions through FLAG_SECURE.

                        ┌──────────────────────────┐
                        │  Window created           │
                        │  onCreate()               │
                        └────────┬─────────────────┘
                                 │
                    ┌────────────▼────────────┐
                    │ disable_secure_flag     │
                    │ = true? (default)       │
                    └────────────┬────────────┘
                    ┌────────────┼────────────────┐
                    │ Yes        │ No              │
                    │ (default)  │                 │
              ┌─────▼─────┐    ┌─▼──────────────┐
              │ FLAG_SECURE│    │ SCREEN_SECURITY│
              │  NOT set   │    │  enabled?      │
              └───────────┘    └─┬──────────────┘
                            ┌────┴────┐
                            │ Yes     │ No
                      ┌─────▼──┐  ┌──▼──────┐
                      │ Apply  │  │  No     │
                      │ SECURE │  │ SECURE  │
                      └────────┘  └─────────┘

4.1.1 File Create & Copy Detection

Every new file observed via MediaStore scanning triggers file-create tracking in RansomwareBehaviorGuard.onFileEvent():

FILE_CREATED: Each genuinely new file (not a rename match) gets a FILE_CREATED:path=...:size=... behavior flag. Bursts of ≥5 creates within 60s get FILE_CREATED_BURST:N.
FILE_COPY: When a new file appears AND FileReadEstimator has a recent read (within 30s) for the same foreground package with a size match within 15% tolerance, a FILE_COPY:size=N:src_size=N:src=PATH:conf=% flag is emitted — correlating the read source with the new destination file.

Data sources:

FileReadEstimator.getRecentReadsByPackage(pkg) — returns recent read estimates for copy correlation
RansomwareBehaviorGuard.fileCreateBurst — tracks per-package create counts in a 60s sliding window

4.2 Zero Trust Screen OCR (Detection)

The app can actively capture screen frames and scan them for threats using on-device ML Kit OCR:

Service: ScreenCaptureService — a MediaProjection-based foreground service
Rate: Captures a frame every 4 seconds
OCR: ML Kit text recognition (Latin script model) — no network calls, fully on-device
Scanning: Recognized text is fed to:
- NativeScanner.scanText() — immediate YARA-X matching against the hydradragon.screen_text module
- NetworkObservations.addScreenText() — stored for future APK scan correlation
Toggle: Settings → Zero Trust screen scanning (screen_ocr, default false)
Consent: Requires per-session user consent via MediaProjectionManager.createScreenCaptureIntent()
Android 14+: Declares FOREGROUND_SERVICE_MEDIA_PROJECTION permission and foregroundServiceType="mediaProjection"

┌──────────────────┐     capture frame     ┌──────────────────┐
│  Screen          │ ────────────────────► │ ScreenCapture    │
│  (any app)       │     every 4s         │ Service          │
└──────────────────┘                      └────────┬─────────┘
                                                   │
                                            ┌──────▼──────┐
                                            │ ML Kit OCR  │
                                            │ (Latin)      │
                                            └──────┬──────┘
                                                   │
                                            ┌──────▼──────┐
                                            │ Recognized  │
                                            │ text        │
                                            └──────┬──────┘
                                                   │
                           ┌───────────────────────┼───────────────┐
                           │                       │               │
                    ┌──────▼──────┐         ┌──────▼──────┐
                    │ YARA-X scan │         │ NetworkObs  │
                    │ (immediate) │         │ (store for  │
                    └─────────────┘         │ future)     │
                                            └─────────────┘

4.3 YARA-X Integration

The Rust native scanner (hydradragonandroid/src/lib.rs) feeds OCR text into scans as "screen_text" module metadata. YARA-X rules can match against on-screen text using:

import "hydradragon"

rule detected_scam_text {
    condition:
        hydradragon.screen_text contains "bank account"
}

4.4 Settings & Defaults

Setting	Key	Default	Description
Allow screen recording	`disable_secure_flag`	`true`	When ON, `FLAG_SECURE` is cleared — external screen recorders can capture the app's UI
Screen recording protection	`behavior_detect_screen_security`	`true`	Master toggle for the entire FLAG_SECURE + tamper detection subsystem
Zero Trust screen scanning	`screen_ocr`	`false`	When ON, starts `ScreenCaptureService` to periodically OCR the screen for threat detection

5. Behavioral Detection Suite (Runtime)

A dedicated set of runtime detectors, each individually toggleable from Settings:

Detector	Toggle Key	Function
UI/Notification Spam	—	Identifies adware-style apps with aggressive notification behavior
Device Rooted Mid-Session	—	Monitors for root access appearing after app installation
Permission+DNS Risk Score	—	Combines permission analysis with DNS query patterns for risk scoring
Ransomware Behavior	—	Active file I/O + screen interaction pattern analysis (see Ransomware-Defense)
Crypto-Miner Detection	`behavior_detect_miner`	Profiles `/proc/<pid>/stat` (CPU ticks) + `/proc/<pid>/status` (VmRSS) every 15s; flags if >20% CPU + >20MB VmRSS sustained for ≥45s or known miner process name matched. Feeds `miner_events` JSON to YARA-X. Threat type: `PUA`.
File Read Estimation	`behavior_detect_file_read_estimator`	Side-channel I/O profiling via `/proc/<pid>/io` read_bytes deltas matched against known file sizes (±10%, min 4KB). Scoring: size match (50%) + recency (30%) + cache ratio (15%) + per-process memory (5%). Reports `FILE_READ` behavior flags.
Wiper Detection	`behavior_detect_wiper`	In `RansomwareBehaviorGuard.checkDeletions()`: tracks known files via directory snapshots; if ≥10 files disappear in 60s + foreground app has >64MB per-process memory → `WIPER_CONFIRMED` flag + kill + uninstall.

Every hit immediately:

Kills the offending app's background process (where possible)
Pops the system uninstall prompt

6. Crypto-Miner Detection (Runtime)

MinerDetector profiles running processes via the /proc filesystem:

CPU: Reads /proc/<pid>/stat utime+stime ticks every 15s, computes CPU % from delta vs wall clock
Memory: Reads /proc/<pid>/status VmRSS (resident set size in kB) every 15s
Sustained threshold: >20% CPU AND >20MB VmRSS for ≥45s (3 consecutive samples)
Known names: Checks /proc/<pid>/cmdline and /proc/<pid>/comm against a hardcoded list of known miner process names (e.g. xmrig, minerd, ccminer, ethminer)
Reports structured data: Calls HipsMonitor.addMinerEvent(package, cpu, memory, knownName, isMalicious) — no raw flag strings
YARA-X integration: 4 module functions — miner_count(package_re), miner_cpu(package_re), miner_memory(package_re), miner_known_name(name_re)

┌──────────────┐    /proc/<pid>/stat      ┌──────────────────┐
│ /proc/       │ ────────────────────────►│ MinerDetector    │
│ filesystem   │    /proc/<pid>/status    │ (15s interval)   │
│              │    /proc/<pid>/cmdline   └────────┬─────────┘
└──────────────┘                                   │
                                          ┌────────▼────────┐
                                          │ >20% CPU +      │
                                          │ >20MB VmRSS     │
                                          │ for ≥45s?       │
                                          └────────┬────────┘
                                                   │ Yes
                                          ┌────────▼────────┐
                                          │ HipsMonitor     │
                                          │ addMinerEvent() │
                                          └────────┬────────┘
                                                   │
                                          ┌────────▼────────┐
                                          │ YARA-X rules    │
                                          │ miner_count()   │
                                          │ miner_cpu()     │
                                          └─────────────────┘

7. File Read Estimation (Side-Channel I/O Profiling)

FileReadEstimator estimates which files a process is reading without hooking file I/O:

/proc/<pid>/io read_bytes samples every 30s
Computes delta between consecutive samples
Matches delta against known file sizes (±10% tolerance, minimum 4KB)
Best match (size + recency + cache ratio + per-process memory) → FILE_READ:pid=N:size=S:file=PATH:conf=%:cache=% behavior flag
Guarded by BehaviorDetectionSettings.FILE_READ_ESTIMATOR toggle

8. Wiper Detection

In RansomwareBehaviorGuard.checkDeletions():

Maintains directory snapshots (knownNamesByDir) of observed directories
On each check cycle (30s), rescans directories and compares actual files against snapshots
Tracks deletions per app in deletionsByPackage
If ≥10 files disappeared in 60s + foreground app has >64MB per-process memory → WIPER_CONFIRMED flag
Response: BehaviorResponse.killAndPromptUninstall
Guarded by BehaviorDetectionSettings.WIPER toggle

9. Behavior Graph UI

Per-app and device-level behavior visualization via BehaviorGraphFragment:

Radar chart: 8-axis spider/radar chart (BehaviorRadarChart Canvas custom View) — Network, File Ops, Permissions, Malware, Wiper, System, Miner, Spam
Detail list: 18-field breakdown below the chart (behavior flags, file reads, miner events, r/w bytes, DNS queries, etc.)
Device-level: "Behavior Graph" button on DashboardFragment
Per-package: "Behavior Graph" button in ScanFragment threat click dialog
Data source: BehaviorGraphData model populated via HipsMonitor.collectBehaviorData()

10. Bloatware Cleaner

Background cleanup tool for removing pre-installed bloatware and suspicious apps, integrated into the Settings UI.

11. Launcher Change Detection

Detects when a third-party app takes over as the default home/launcher — a common persistence and click-fraud technique.

At the start of every scanAllApps() sweep, resolves Intent.CATEGORY_HOME to find the current default launcher
Compares with the previously observed launcher package
If changed, emits a LAUNCHER_CHANGE behavioral signal via HipsMonitor
Non-system apps replacing the launcher are flagged as suspicious
The signal feeds the hydradragon.launcher_change(package_re) YARA-X rule condition
Static DEX analysis also scans for launcher-hijacking API calls (clearPackagePreferredActivities, addPreferredActivity, createRequestRoleIntent) and includes them in auto-generated rules

12. Self-Protection & Root Detection

Device Admin tamper resistance: Prevents unauthorized deactivation of Device Admin
Rooted device detection: Refuses to run on rooted devices (RootCheck)
Debug mode warning: Alerts when USB/wireless debugging is left on (DebugModeCheck)

Uh oh!

Behavioral Protection

Behavioral Protection

1. UI Hijacking / Clickjacking Protection

2. Notification Spam Detection

3. Settings Self-Protection

4. Screen Recording & Capture

4.1 Screen Recording Guard (Prevention)

4.1.1 File Create & Copy Detection

4.2 Zero Trust Screen OCR (Detection)

4.3 YARA-X Integration

4.4 Settings & Defaults

5. Behavioral Detection Suite (Runtime)

6. Crypto-Miner Detection (Runtime)

7. File Read Estimation (Side-Channel I/O Profiling)

8. Wiper Detection

9. Behavior Graph UI

10. Bloatware Cleaner

11. Launcher Change Detection

12. Self-Protection & Root Detection

See Also

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Clone this wiki locally