Skip to content

Detection Engines

Jump to bottom
Emirhan Uçan edited this page Jul 17, 2026 · 13 revisions

Detection Engines

HydraDragonAV Mobile combines multiple scanning technologies to achieve comprehensive Android malware detection.

1. YARA-X (Native Rust)

  • Engine: Custom YARA-X fork with the hydradragon and androguard modules.
  • Modules: The hydradragon module provides per-app DNS/connection attribution (Android 10+). The androguard module provides APK-specific analysis features.
  • Rules: Extensive collection of YARA rules targeting Android malware families.
  • Method: Pattern-based rule matching with conditions and metadata.
  • Auto-generated rules: The native engine generates yarGen-style rules for confirmed malware, using AND-based multi-condition logic — package name (OR'd if multiple), DEX string pool threshold, and androguard.rootkit_behavior() — so all signals must align to match, reducing FPs.

2. ClamAV (Native Rust)

  • Integration: libclamav signatures compiled into the native Rust engine.
  • Database: Filtered by clam_juice.py to keep only Android-relevant platforms (Andr, Unix, Linux, Email, PUA) plus all Phishing signatures. Windows/OSX/Java signatures are excluded.
  • Method: Signature-based pattern matching.
  • File-type gate: Both ClamAV and YARA-X only run at all on a file confidently identified as APK/ZIP, DEX, ELF, HTML, ASCII text, PDF, or an image — desktop-only formats (PE, OLE2, Mail, Mach-O, SWF, Java) and files of an indeterminate type are skipped outright, not just rejected signature-by-signature. See ClamAV-Integration.

3. TLSH Fuzzy Hashing

  • Engine: Pure-Rust TLSH implementation (tlsh-rs).
  • Database: MalwareBazaar-derived TLSH digest database (APK/ELF/SO/DEX).
  • Method: Compares scanned files against known-malware digests to find similar-but-not-identical samples.

4. ML Anomaly Detection

  • MinHash/LSH + Isolation Forest: Scores every scanned sample with a Jaccard similarity and anomaly score, flagging outliers that don't match any known-clean or known-malware profile.
  • AIEngine: Lightweight logistic-regression classifier that scores DEX-level behavior — obfuscation, dynamic loading, crypto/socket/shell APIs, adware SDKs.

5. Malicious URL String Scanner

  • Method: Extracts every embedded http(s):// URL from raw bytes of scanned files (APK or otherwise).
  • Filter: Checks extracted URLs against native malware/phishing URL XOR filters.
  • Advantage: Full URL with path is far more specific than bare domain, reducing false positives.

6. NSRL-Backed Whitelisting

  • Dual layer: Binary-fuse XOR filter (in-memory, SHA-256 hashes) + SQLite database (full package metadata).
  • Purpose: Known-good software is never flagged. See NSRL-Whitelisting.

7. Native-Code Emulation (Unicorn Engine)

  • Engine: Unicorn CPU sandbox (ARM/ARM64/x86/x86_64).
  • Method: Runs embedded native library JNI_OnLoad/entry code in a bounded, syscall-free environment.
  • Purpose: Reveals runtime-decoded strings (e.g., C2 URLs) that never appear in static analysis.

Engine Comparison

Engine Type Speed False Positives Offline
YARA-X Pattern Rules Very Fast Low-Medium Yes
ClamAV Signatures Fast Very Low Yes
TLSH Fuzzy Hash Fast Low Yes
ML (Isolation Forest) Anomaly Detection Medium Low Yes
AIEngine Logistic Regression Fast Low-Medium Yes
URL Scanner XOR Filter Very Fast Very Low Yes
Unicorn CPU Emulation Slow Low Yes

Detection Flow

┌─────────────────────────────────────────────────────────────┐
│                    File / APK Scan Request                   │
└────────────────────────┬────────────────────────────────────┘
                         │
                    ┌────▼────┐
                    │  NSRL   │
                    │ Whitelist│
                    └────┬────┘
                         │ (if not whitelisted)
                    ┌────▼────┐
                    │  ML     │
                    │  Score  │
                    └────┬────┘
                  ┌──────┴──────┐
                  │             │
        confident benign   uncertain/malicious
                  │             │
                  │        ┌────▼────┐   ┌────▼────┐
                  │        │ YARA-X  │   │ ClamAV  │
                  │        │ Scan    │   │ Scan    │
                  │        └────┬────┘   └────┬────┘
                  │             │             │
                  │        ┌────▼────┐   ┌────▼────┐
                  │        │  TLSH   │   │Unicorn  │
                  │        │  Match  │   │Emulation│
                  │        └────┬────┘   └────┬────┘
                  │             │             │
          ┌───────┼─────────────┼─────────────┘
          │       │             │
     ┌────▼────┐  │        ┌────▼────┐
     │  Clean  │  │        │Malicious│
     │  Allow  │  │        │  Action │
     └─────────┘  │        └─────────┘
                  │
                  │  (suspicious alerts
                  │   from AIEngine)

See Also

Clone this wiki locally