Glossary

Glossary

Technical terms, abbreviations, and concepts used throughout HydraDragonAV Mobile documentation.

A

Term	Definition
Accessibility Service	Android service that observes user interactions and screen content. Used by DynamicAnalysisService for on-screen threat detection.
AIEngine	Lightweight Java-side logistic-regression classifier (BIAS = -2.0) that scores DEX-level behavior from 8 boolean code-feature flags. Corroboration-only.
API 29	Android 10 API level — minimum requirement for per-app network attribution via getConnectionOwnerUid.
APK	Android Package Kit — Android application format.
ARP Spoofing	Network attack where an attacker sends fake ARP messages to associate their MAC with another device's IP.
AXML	Android XML binary format used in compiled AndroidManifest.xml files. Parsed by the native engine.

B

Term	Definition
Behavioral Detection Suite	Runtime detectors for UI spam, root-online detection, permission+DNS risk scoring, and ransomware behavior.
Binary-Fuse XOR Filter	Probabilistic filter data structure for fast set membership queries. Used by the NSRL whitelist layer for O(1) hash lookups. Also used for malicious URL/IP/domain lookups.

C

Term	Definition
CA (Certificate Authority)	Trusted entity that issues digital certificates. HydraDragonAV Mobile never installs a CA certificate.
C2 (Command & Control)	Server that malware communicates with to receive instructions or exfiltrate data.
ClamAV	Open-source antivirus engine. HydraDragonAV Mobile uses a filtered Android-relevant subset of ClamAV signatures.
Clickjacking	Attack that tricks users into clicking something different from what they perceive.

D

Term	Definition
DEX	Dalvik Executable — Android's bytecode format contained within APKs.
DNS	Domain Name System — translates domain names to IP addresses. Web Shield filters DNS lookups.
DnsVpnService	Local VPN service that filters DNS queries against known-malicious domains.
DynamicAnalysisService	Accessibility Service component for on-screen text scanning and clickjacking prevention.

E

Term	Definition
ELF	Executable and Linkable Format — native binary format for Android's shared libraries (.so files).

F

Term	Definition
FLAG_SECURE	Android window flag that prevents the window's content from appearing in screenshots or on insecure displays.
FLAG_WINDOW_IS_OBSCURED	Android flag checked by Settings to detect overlay-based tapjacking.
Foreground Service	Android service with a persistent notification, less likely to be killed by the system. GuardService runs as one.

G

Term	Definition
GuardService	Persistent foreground service that monitors the Downloads folder and orchestrates scans 24/7.

J

Term	Definition
Jaccard Similarity	Measure of similarity between two sets. Used by benign_db.rs's 64-permutation MinHash to compare APK content signatures (threshold ≥ 0.85 ⇒ known-benign skip).
JNI	Java Native Interface — bridge between Java/Kotlin and native Rust code (libhydradragonandroid.so).

L

Term	Definition
launcher_change	Newest hydradragon module export — scores default-home/launcher hijack attempts (attempt=1, actual change=4, suspicious actual change=8).

M

Term	Definition
MediaProjection	Android API for capturing screen content. Used by ScreenCaptureService for periodic OCR.
MinHash	Technique for estimating Jaccard similarity between sets. Used in benign_db.rs (64 permutations, FNV-1a) for the benign-content whitelist — not the ML classifier.
MITM	Man-in-the-Middle — attack where the attacker intercepts communication between two parties. Detected by MitmDetector.

N

Term	Definition
NSRL	National Software Reference Library — U.S. NIST project providing hash sets of known software. Used for whitelisting.
Network Monitor	Component that tracks live connections, flags malicious IPs, MITM, and ARP spoofing.

P

Term	Definition
Photon	Ultra-fast scan caching engine using ConcurrentHashMap to instantly re-verify previously scanned safe apps.

R

Term	Definition
Ransomware File Traps	Decoy files placed in storage directories to detect ransomware by monitoring for unauthorized modification.
Rename-Burst Detection	Detection of mass file rename operations — the universal signature of in-place file encryption by ransomware.

S

Term	Definition
ScreenCaptureService	MediaProjection-based service that periodically captures and OCRs the foreground screen.
Shizuku	Android shell-privilege framework. HydraDragonAV Mobile deliberately avoids Shizuku integration.
Smishing	SMS phishing — text message scams designed to trick users into revealing personal information. Detected by on-screen OCR.
StrandHogg	Android task-hijacking vulnerability where a malicious app can overlay its activity on top of legitimate apps.

T

Term	Definition
Tapjacking	Attack using invisible overlays to intercept user taps. Prevented by FLAG_WINDOW_IS_OBSCURED checks.
TLS	Transport Layer Security — cryptographic protocol for secure communication.

U

Term	Definition
Unicorn Engine	CPU emulation framework used by HydraDragonAV Mobile to sandbox-execute native code for runtime string recovery.

V

Term	Definition
VpnService	Android API for implementing local VPN services. Used by Web Shield for DNS filtering without traffic proxying.

W

Term	Definition
Web Shield	DNS-filtering VPN feature that blocks resolution of known-malicious/phishing domains.
Whitelist	NSRL-backed two-layer (XOR filter + CSV) system for identifying known-good software. XOR filter checks SHA-256 hashes; CSV (whitelist_packages.csv) matches package key + MD5. Both are generated offline from the NSRL SQLite RDS and bundled as APK assets.

X

Term	Definition
XOR Filter	See Binary-Fuse XOR Filter.

Y

Term	Definition
YARA-X	Rust reimplementation of the YARA pattern-matching engine. Used by the native scanner with the custom hydradragon module.

Z

Term	Definition
Zero-Trust Mode	Optional stricter mode where apps that merely survive all detectors (rather than being explicitly cleared) are still flagged.
Zero-Day	Previously unknown malware or exploit for which no signature exists. Detected via ML anomaly, behavioral analysis, and emulation.