LIVE FEED
Overview Architecture Detection Install Demo Team GitHub ↗

Android Runtime Security · MITRE ATT&CK · v1.0.0

Dynamic
Behavior
Profiler

End-to-end behavioral surveillance for Android applications. Collect runtime signals via ADB, detect anomalies with ML, and get AI-powered root-cause analysis — all without touching the app under analysis.

✓ MIT License ✓ Open Source ⚡ v1.0.0 MITRE ATT&CK Mapped 100% Local AI
View on GitHub Watch Demo ↓

Performance

Built for production

Measured on a real Android emulator under controlled conditions. Consistent across all test scenarios.

<3sLATENCY
Detection Speed
0%FALSE POS.
False Positive Rate
~80MBMEMORY
Memory Footprint
100%LOCAL AI
Local AI Inference
6RULES
MITRE ATT&CK Rules
<1sCOLLECTION
Event-to-Dashboard

Zero instrumentation.
Full visibility.

Connect to any debuggable Android device or emulator via ADB. No root access, no code injection, no app modification required.

  • Collects 6 real-time behavioral signals via ADB logcat
  • Weighted z-score scoring with dynamic 0–100 risk scale
  • Incident lifecycle: Open → Active → Closed
  • SOC triage: Acknowledge / Mitigate / False Positive
  • Local LLM (phi3 via Ollama) — no data leaves the machine
profiler / main.py — localhost:5000

MITRE ATT&CK Kill Chain

From signal to classification

Every detected anomaly is instantly mapped to a MITRE ATT&CK tactic, enabling correlation with existing threat intelligence databases.

Phase 01
Exfiltration
Data Exfiltration
T1048
Phase 02
Command & Control
Infinite Retry Loop
T1071.001
Phase 03
Impact
Request Spam
T1498
Crash Storm
T1499.004
Silent App Hang
T1499
Timeout Pattern
T1499
Phase 04
AI Analysis
Root Cause
phi3 via Ollama
Remediation Steps
Local LLM
Phase 05
SOC Triage
Acknowledge
Operator action
Mitigate / FP
Feedback loop

Software Architecture

Three-tier decoupled design

High cohesion between signal generation, analysis intelligence, and SOC visualization.

Layer 01
Generation
BehaviorTestApp runs on an Android emulator (Pixel 6 Pro, API 37) and generates five distinct behavioral patterns. All telemetry is native, relying on standard Android SDK mechanisms.
JavaAndroid SDK API 37OkHttpPixel 6 Pro AVD
Layer 02
Analysis
The Python profiler continuously polls behavioral signals via ADB. The detector applies weighted z-score derivations, maps findings to MITRE ATT&CK, and orchestrates a local LLM for root-cause generation.
Python 3.10+Flask 3.1ADBOllama phi3Z-Score
Layer 03
Visualization
A responsive single-page SOC dashboard polls the backend every second with five views: live metrics, raw signal feed, MITRE kill chain, AI root-cause analysis, and exportable audit reports.
HTML5 / JSChart.jsREST/JSONServer-Sent Events

Detection Engine

MITRE ATT&CK mapped rules

Six detection rules covering the most critical Android runtime attack patterns.

Data Exfiltration Pattern
T1048 · Exfiltration
Detects anomalous outbound data transfer patterns consistent with unauthorized exfiltration attempts.
CriticalConfidence: High
Request Spam
T1498 · Impact
6 parallel threads with no throttle generate high-volume network floods detected via RPM spike.
HighConfidence: Low
Infinite Retry Loop
T1071.001 · C2
Continuous retry on 401 without exponential backoff, signaling potential C2 or broken auth logic.
HighConfidence: Low
Crash Storm
T1499.004 · Impact
NullPointerException every 500ms creates a cyclic crash pattern monitored via crash counter.
HighConfidence: Low
Silent App Hang
T1499 · Impact
Application unresponsive without explicit errors. Detected through latency spikes with near-zero RPM.
HighConfidence: Medium
Timeout / Slow Response
T1499 · Impact
10s server delay vs 5s client timeout generates persistent timeout patterns.
MediumConfidence: Low

Comparison

Why Dynamic Behavior Profiler?

The only tool combining real-time ADB monitoring, MITRE ATT&CK classification, and AI diagnostics in a single deployable package.

FeatureDBP (Ours)DroidBoxCopperDroidDeepLog
Real-time monitoring✓✗✗Partial
No app modification needed✓✗✗✓
MITRE ATT&CK mapping✓✗✗✗
AI root-cause analysis✓✗✗✗
Web SOC dashboard✓✗✗✗
REST API✓✗✗✗
Open source✓✓✗✓
Android-native✓✓✓✗
No root required✓✗✗✓
Detection latency< 3 secondsOfflineOfflineBatch

Getting Started

Up and running in minutes

No complex infrastructure required. Just Python, ADB, and an Android device or emulator.

01
Clone the repository
Fork or clone the project to your local machine.
git clone https://github.com/Abdeljalil-Fajri/AndroidBehaviorAnalysis.git
02
Install Python dependencies
Navigate to the profiler directory and install requirements.
cd profiler && pip install flask flask-cors colorama requests
03
Pull the local LLM
Download and run phi3 locally via Ollama — no API key, no cloud.
ollama pull phi3 && ollama serve
04
Connect your Android device
Enable USB debugging on your device or start an emulator, then verify ADB sees it.
adb devices
05
Launch the profiler
Start the Flask backend, then open profiler/static/index.html for the live SOC dashboard.
python main.py

Video Demonstration

See it in action

End-to-end walkthrough: baseline calibration, attack simulation, real-time detection, AI root-cause analysis, and audit export.

0:00Normal Baseline Calibration
0:14Attack Simulation: Request Spam
1:03Real-Time SOC Detection
1:14Incident Mitigation
1:18AI Root Cause Analysis
1:44Chatbot Interaction
2:40Viewing & Exporting Audit Report

REST API

OpenAPI 3.0 documented

All profiler data exposed through a Swagger-documented Flask API, ready for SIEM integration.

MethodEndpointDescription
GET/api/statusServer health, tracking metadata, baseline status
GET/api/signals/currentLatest 1-second signal snapshot
GET/api/signals/historyRolling 60-second telemetry history
GET/api/logsLast 50 raw logcat lines
GET/api/incidentsAll detected incidents for the active session
POST/api/analyzeTrigger on-demand AI root cause analysis
POST/api/incidents/:id/triageSet status: acknowledged / mitigated / false_positive

Published Research

Read the paper

This project is backed by a peer-reviewed article submitted to the Software Impacts journal.

Software Impacts · 2025/2026
Dynamic Behavior Profiler: Runtime Behavioral Monitoring and Anomaly Detection for Android Applications
Abdeljalil Fajri, Mohammed Ait Ourajli, Yasser Chettour, Zakaria Aouianti — ENSAM Marrakech, Cadi Ayyad University
Android SecurityAnomaly DetectionMITRE ATT&CKRuntime ProfilingFlask
Read Paper ↗

Contributors

Built at ENSAM Marrakech

Developed within the Android Mobile Application Programming and Security module at École Nationale des Sciences Appliquées de Marrakech, Cadi Ayyad University — 2025/2026.

Android Development
Zakaria Aouianti
BehaviorTestApp — five anomaly simulation scenarios on Android SDK API 37.
Anomaly Detection
Yasser Chettour
Z-score detection engine, MITRE ATT&CK rule mapping, incident lifecycle.
GitHub ↗
Backend & Infrastructure
Abdeljalil Fajri
Flask REST API, ADB signal collection, OpenAPI documentation, project architecture.
GitHub ↗
Dashboard & AI
Mohammed Ait Ourajli
SOC web dashboard, Ollama/phi3 LLM integration, AI root-cause analysis UI.
GitHub ↗
Supervisor
Prof. Mohamed Lachgar
Supervision and guidance throughout the project development at ENSAM Marrakech.
ResearchGate ↗