An On-Device AI-Driven Cybersecurity Agent for Mobile Protection
Aigris is an innovative, proactive cybersecurity agent designed to run entirely on-device. By eliminating cloud reliance, it guarantees absolute user privacy and zero data leakage. The project is highly optimized for consumer hardware, strictly adhering to resource constraints (Target: < 5% CPU usage when idle, 100-200MB RAM footprint).
The architecture of Aigris is natively modular, ensuring seamless scalability across different target audiences:
- Phase 1 (Current Target - Consumer Protection): Focused on real-time, proactive defense against everyday cyber threats and financial scams targeting regular users.
Phase 1 aims to detect and automatically intercept the most critical vectors used against consumer devices:
- Phishing & Brand Abuse (Active): Real-time geometric and predictive analysis of URLs (from SMS, messaging apps, and browsers) via machine learning to neutralize credential theft attempts.
- Malware & Device Exploits (Upcoming): Local, lightweight detection of basic trojans, ransomware, and spyware behavior.
- Browser Security (Upcoming): Defense against malicious extensions, scripts, and drive-by downloads.
- Banking Scams & Identity Theft (Upcoming): Monitoring for social engineering patterns and anomalous credential input windows.
- Network Security (Upcoming): Rogue Wi-Fi hotspot detection (e.g., Evil Twin attacks).
The current engine implements a system-wide URL interception pipeline using high-performance Android native components:
- AI Engine (
core&detector): A custom logical pipeline that extracts structural/geometric features from URLs, combining them with a trained machine learning model executed locally via native ONNX Runtime. - Background Interceptor (
service): Powered by an Android Accessibility Service. This engineering choice bypasses modern Android OS restrictions on deep links, allowing Aigris to extract the complete URL string (including deep paths and queries) directly from the address bars of major mobile browsers (Google Chrome, Microsoft Edge, Samsung Internet). It neutralizes threats before the browser renders the malicious payload, ensuring zero friction for the end user. - User Interface (
ui): Includes a secure laboratory sandbox for manual testing and an un-bypassable warning screen (WarningActivity) that intercepts and halts user navigation upon confirming a high-risk phishing threat.
- Architecture: 100% On-Device (No remote servers, no cloud APIs utilized for analysis).
- Target OS: Android 13+ (API Level 33+).
- Efficiency: Under 200MB RAM utilization, < 5% CPU overhead during background monitoring state.