بنك أسئلة المناقشة والدفاع

Model answer / الإجابة النموذجيةDroidX combines 100% offline Android risk scoring, static PackageManager inspection, deterministic permission-chain heuristics, a compact INT8 MLP, and a local XAI translation layer. The design targets privacy and resource constraints instead of depending on cloud telemetry or continuous background processing.

Model answer / الإجابة النموذجيةThe complete static corpus contains 11,598 applications: 9,803 malware and 1,795 benign samples, giving an 84.52% malware ratio. Stratified splitting produces 8,118 training samples, 1,740 validation samples, and an isolated 1,740-sample test set while preserving class proportions.

Model answer / الإجابة النموذجيةThe pipeline removes dynamic traces and non-static metadata that cannot be read reliably offline through PackageManager. Gini-importance filtering retains a frozen, auditable schema of 255 official Android SDK features covering manifest permissions, hardware features, and intent actions. This reduces the feature space by approximately 94.5% while keeping the input reproducible on-device.

Model answer / الإجابة النموذجيةStatic analysis provides an offline-readable signal before execution, avoids sandbox evasion and runtime cost, and fits the privacy-first mobile constraint. Its limitation is that it cannot observe behavior hidden behind dynamic code paths; DroidX therefore presents permission chaining as a high-signal surface rather than claiming complete behavioral coverage.

Model answer / الإجابة النموذجيةAffine quantization maps a float x to an integer q using q = round(x / scale) + zero-point, then approximates x with scale × (q − zero-point). Integer tensors reduce storage and memory bandwidth; calibration preserves the useful range, while accuracy and recall checks verify the trade-off. The workspace model telemetry records a 23 KB footprint, below the thesis limit of 50 KB.

Model answer / الإجابة النموذجيةThe thesis requires quantized inference below 50 ms per application, a complete extraction-to-XAI audit below 3 seconds, and peak batch RAM below 50 MB. The workspace evaluation telemetry records 18.4 ms observed inference, while the report defines the sub-50 ms value as the acceptance target.

Model answer / الإجابة النموذجيةThe explanation layer maps active features and model weights to semantic contexts such as persistence, communication, surveillance, and privilege escalation. It combines dominant contributors with deterministic chain triggers and turns them into plain-language indicators plus least-privilege remediation guidance.

Model answer / الإجابة النموذجيةA single permission can be legitimate, while combinations such as SMS access paired with Internet access and boot persistence can indicate interception, exfiltration, and persistence together. DroidX keeps the rule engine deterministic and auditable, using the chain as a contextual risk signal alongside the MLP rather than treating every dangerous permission as malware.

Model answer / الإجابة النموذجيةPlay Integrity is a complementary external trust signal about the app or device environment, while PackageManager supplies local package metadata. The core static risk score remains offline; integrity evidence can flag tampered or untrusted contexts and the design includes an offline fallback when the check is unavailable.

Model answer / الإجابة النموذجيةDroidX is bounded by its frozen 255-feature vocabulary and static-analysis boundary. It cannot reliably observe runtime reflection, dynamic code loading, or code injection inside classes.dex, and new Android SDK signals outside the schema require a controlled retraining and schema update. These limits are stated explicitly rather than hidden behind a black-box claim of complete detection.