Skip to content

Network Security

Jump to bottom
Emirhan Uçan edited this page Jul 15, 2026 · 3 revisions

Network Security

HydraDragonAV Mobile provides comprehensive network-level threat detection and filtering without requiring root, a CA certificate, or traffic decryption.

1. Web Shield (DNS-Filtering VPN)

A local, on-device VPN service that filters DNS lookups against known-malicious domains.

  • Mechanism: Uses VpnService to intercept DNS queries at the device level.
  • Scope: Blocks resolution of known-malicious/phishing domains.
  • Limitation: No traffic proxying, decryption, or inspection — only DNS lookups are filtered.
  • No CA required: Unlike HTTPS-filtering VPNs, Web Shield never needs to install a CA certificate.
┌─────────┐     DNS query     ┌──────────────┐
│   App   │ ────────────────► │ DnsVpnService │
└─────────┘                   └──────┬───────┘
                                     │
                            ┌────────▼────────┐
                            │ Domain in       │
                            │ malicious       │
                            │ xor filter?     │
                            └────────┬────────┘
                                     │
                    ┌────────────────┼────────────────┐
                    │ Yes            │ No             │
               ┌────▼────┐     ┌─────▼─────┐
               │  BLOCK  │     │  ALLOW    │
               │ NXDOMAIN│     │ forward to│
               │         │     │ real DNS  │
               └─────────┘     └───────────┘

2. Network Security Monitor

Tracks live network connections and flags suspicious activity:

Feature Detection Method
Malicious IPs / C2 Connection destinations checked against known-malicious IP XOR filters (only public IPv4 addresses are scanned — private/loopback/multicast/reserved ranges are rejected by isValidPublicIp() before hitting the filter)
Anonymizer/Tunnel Domains Flags dyndns, ngrok, .onion lookup attempts
MITM / TLS Interception Detects untrusted CA certificates in the device trust store
ARP Spoofing Monitors local network ARP tables for duplicate IPs / MAC mismatches

Per-app attribution (Android 10+): Each connection is attributed to the exact app that made it via ConnectivityManager.getConnectionOwnerUid. This enables granular per-app network risk scoring.

3. Malicious URL String Scanner

Scans files and APKs at rest for embedded malicious URLs:

  • Extracts every http(s):// URL from raw file bytes
  • Checks against native malware/phishing URL XOR filters
  • Full URL with path matching — more precise than domain-only

4. Combined Risk Scoring

The Behavioral Detection Suite combines permission analysis with DNS query patterns:

  • Apps with INTERNET + dangerous permissions making unusual DNS queries
  • Apps querying known-malicious or sinkhole domains
  • Automated scoring triggers alerts and recommended actions

Comparison

Feature Web Shield Network Monitor URL Scanner
Scope Live DNS filtering Live connection tracking Static file analysis
Requires VPN Yes No No
Requires Android 10+ No Per-app attribution only No
Blocks traffic Yes (DNS level) No (monitoring only) No
Root needed No No No
CA cert needed No No No

See Also

Clone this wiki locally