DROIDX_HUB PROJECT DEFENSE PRESENTATION
Slide 1 of 19
Al-Rasheed Smart University Logo

AL-RASHEED SMART UNIVERSITY | FACULTY OF ENGINEERING & IT

Department of Cybersecurity

Graduation Project I Defense Presentation

DroidX: An On-Device Intelligent Android Risk Scoring & Malware Detection Application

Based on Permission Chaining and TinyML

Prepared By (Student Team):

Talal Khalid Omar202310100127

Abdulrahman Ameen AL-Sattani202310100190

Supervised By:

Prof. Jamel SaadAcademic Supervisor

Eng. Ahmed MotaharAssistant Supervisor

Documentation-Driven Architecture & Empirical Training Defense | Sana'a, Yemen - 2026

Background & Context

Slide 02 / 19
SECTION 01
HOST PLATFORM ENVIRONMENT
  • Targeting Android 10.0+ (API Level 29+).
  • Linux UID sandbox process isolation.
  • Manual user approval for hardware/data access.
SECTION 02
CURRENT DETECTION MECHANISMS
  • Signature matching (e.g., SHA-256 hashes).
  • Cloud telemetry inspection & remote analysis hubs.
  • Google Play Protect & commercial MTD tools.

Problem Statement

Slide 03 / 19
PROBLEM 01
TELEMETRY EXFILTRATION

Commercial tools transmit app inventories, usage patterns, and device IDs to cloud servers, causing privacy and surveillance risks.

PROBLEM 02
EDGE HARDWARE CONSTRAINTS

Standard deep neural networks cause thermal throttling, RAM saturation, and rapid battery exhaustion when executed locally.

PROBLEM 03
PERMISSION CHAINING

Traditional static scanners evaluate permissions in isolation, failing to detect dangerous multi-permission combinations.

PROBLEM 04
BLACK BOX USABILITY GAP

Security tools output raw probability scores or CVE tags, leaving non-technical users unable to interpret risks.

Objectives & Aims

Slide 04 / 19
PILLAR 01
ARCHITECTURAL CORE
  • 100% Offline Inspection Engine (zero network telemetry).
  • Optimized Quantized TinyML Classifier (Compact footprint).
  • Comprehensive Feature Matrix from CICMalDroid2020.
PILLAR 02
INTELLIGENCE & DEFENSE
  • Deterministic Permission-Chaining Heuristics.
  • Explainable AI (XAI) Plain-Language Guidance.
  • Google Play Integrity API & Local Diagnostics.
PILLAR 03
PERFORMANCE TARGETS
  • High Detection Accuracy and reliability standards.
  • Fast on-demand scan latency in seconds.
  • Minimal RAM footprint with negligible background resource drain.

Scope & Limitations

Slide 05 / 19
IN SCOPE
  • Target Platform: Modern Native Android OS.
  • Target Audience: Everyday users and enterprise personnel.
  • Inspection Scope: Manifest analysis (permissions, intent filters, hardware tags).
  • Execution Mode: On-demand local scans without background polling.
OUT SCOPE
  • Static Analysis Limit: Cannot inspect runtime code loading (DCL) or reflection.
  • Repackaged App Blind Spot: Modified packages preserving benign manifests display lower static risk.
  • Dataset Vocabulary: Neural weights operate over a structured feature schema.

Constraints Matrix

Slide 06 / 19
HARDWARE & MEMORY CONSTRAINTS
  • RAM Footprint: Strictly optimized and bounded volatile memory usage during scans.
  • Storage Size: Highly compact model binary and lightweight application package.
  • CPU/Battery: Zero idle background daemon usage; no noticeable battery drain.
SECURITY & SYSTEM BOUNDARIES
  • Zero Network Access: Complete omission of internet connectivity permissions.
  • Non-Root Execution: Strictly bounded within standard Linux UID sandbox.
  • Fallback Diagnostics: Graceful local fallback if cloud or remote verification is unreachable.

Literature Review & Benchmarking

Slide 07 / 19
System Technology Used Key Advantages Limitations
DREBIN Static Analysis + Linear SVM Fast static classification, low overhead Legacy ML, vulnerable to obfuscation, No XAI
Alfaw et al. TFLite, Deep Learning models High classification accuracy, local execution Higher memory allocation, No XAI, no remediation
Hypatia ClamAV Signatures (Hashes) 100% offline, zero battery drain Signature-based; blind to zero-day malware
DroidX (Proposed) INT8 TFLite MLP + XAI + Rules 100% offline, TinyML, XAI, Chaining Bound by static analysis manifest scope

Methodology & Workflow

Slide 08 / 19
DUAL-TRACK EXECUTION LIFECYCLE
  • Track 1: CRISP-ML Machine Learning & Data Pipeline.
  • Track 2: Native Android Edge System & Field Validation.
  • Agile Sprints: Critical path tracking & milestone sign-offs.
Integrated Agile and CRISP-ML Project Lifecycle

Research Gap (Quadrant II)

Slide 09 / 19
Pillar 1: Data Sovereignty

100% Offline, zero telemetry exfiltration.

Pillar 2: Edge Optimization

Optimized TinyML with minimal execution latency.

Pillar 3: Chaining Engine

Deterministic heuristics for multi-permissions.

Pillar 4: Human XAI

Plain-language threat remediation mapping.

Strategic Mobile Security Landscape

System Requirements

Slide 10 / 19
FUNCTIONAL REQUIREMENTS (FR)
  • FR-01: Static package enumeration via PackageManager.
  • FR-02: Structured feature vector transformation.
  • FR-03: On-device TinyML model inference.
  • FR-04: Deterministic permission-chaining heuristics.
  • FR-05: Explainable AI (XAI) plain-language mapping.
NON-FUNCTIONAL REQUIREMENTS (NFR)
  • NFR-01: Fast inference & rapid complete audit.
  • NFR-02: Bounded volatile memory footprint.
  • NFR-03: Lightweight storage for binaries.
  • NFR-04: High validation accuracy metrics.
  • NFR-05: Zero idle CPU & battery impact.

System Architecture

Slide 11 / 19
4-LAYER DECOUPLED EXECUTION
  1. Extraction Layer: Native PackageManager queries.
  2. Transformation Layer: Feature vector generator.
  3. Dual Inference: TinyML + Heuristics.
  4. Presentation Layer: Material Design 3 XAI.
Proposed DroidX High-Level System Architecture

Use Case & Misuse Case Modeling

Slide 12 / 19
DEFENSIVE INTERACTION MODELING
  • UC-01: Initiate On-Demand Audit.
  • UC-04: Evaluate Multi-Permission Chains.
  • MC-01: Exploit Chaining (Intercepted).
  • MC-02: Telemetry Exfiltration (Mitigated by offline air-gap).
DroidX Use Case and Misuse Case Diagram

Data Flow Diagram (DFD Level 1)

Slide 13 / 19
TRUST BOUNDARIES & DATA FLOW
  • Process 1.0: Manifest Extraction & Sanitization.
  • Process 2.0: Vector Transformation.
  • Process 3.0: TinyML Inference & Chaining.
  • Egress Control: External cloud connection strictly blocked.
DroidX Data Flow Diagram with Security Trust Boundaries

Scenario 1: SMS Banking Trojan

Slide 14 / 19
ATTACK PROGRESSION & DEFENSE
  • Attack Vector: Trojan paired with `RECEIVE_SMS` + `INTERNET`.
  • TinyML Score: Neural network flags high threat probability.
  • Chaining Trigger: Rule PC-01 forces High-Risk verdict.
  • XAI Remediation: Warns user of 2FA OTP theft risk.
SMS Banking Trojan Progression and DroidX Defense Flow

Scenario 2: Repackaged Application Evasion

Slide 15 / 19
STATIC ANALYSIS BOUNDARY
  • Adversarial Path: Disassembles APK, injects bytecode, preserves manifest.
  • Static Limit: Structural audit yields baseline score.
  • XAI Boundary Alert: Discloses limit and recommends signature/dynamic verification.
Repackaged Application Evasion Sequence

System Modeling & Execution Flow

Slide 16 / 19
SEQUENCE & FALLBACK LOGIC
  • Static Inference Flow: Asynchronous coroutine execution across TFLite & XAI.
  • Integrity Check: Play Integrity API verifies bootloader/root states.
  • Offline Fallback: Seamless fallback to local root heuristics when offline.
Sequence Diagram of Static Scan and XAI Inference Flow

Live System Prototype (Demo)

Slide 17 / 19

Thank You

Slide 18 / 19

Thank You for Your Attention!

DroidX: Privacy-First, On-Device Mobile Cybersecurity

Al-Rasheed Smart University | Department of Cybersecurity | 2026

Committee Q&A

Slide 19 / 19

Questions & Examination Session

We welcome feedback, questions, and architectural inquiries from the respected members of the Examination Committee.