Zero data egress. Zero cloud. 100% on-device detection.
-4CAF50?style=for-the-badge&logo=android&logoColor=white&labelColor=0B0F19){kind=icon}
DroidGuard is a privacy-first, on-device threat scanner for Android. It analyzes every installed app — permissions, APK structure, DEX payloads, native libraries, signers, behavior — and fuses the signals through a rules engine, an on-device ML classifier, and a self-learning memory that remembers how you use your device.
🔒 The APK declares no INTERNET permission. Everything — scanning, learning, explaining — happens on your phone.
| 🧠 Self-Learning Engine | Auto-learns which apps/signals are harmless for your usage, suppresses retraining noise, and excludes your trusted apps |
| 🎯 YARA-Style Signature Engine | Binary hex + string pattern matching straight inside APK/DEX payloads (packers, droppers, banking trojans, spyware frameworks) |
| 🧬 Deep APK Forensics | DEX header structural checks (packed/encrypted payloads), native .so ELF validation, Frida/Xposed markers, manifest capability mining |
| 🤖 On-Device ML | Capability-profile classifier — no data ever leaves the device |
| 🩹 Fix-All Remediation | One-tap triage: disable flagged apps, revoke risky capabilities, walk through system settings |
| 🕵️ Live Overlay Monitor | Real-time overlay-window detection while you use your phone |
| 🚦 Install Guard | Scans any APK you try to sideload before it lands, with a hash verdict against the offline threat DB |
| 📊 Cyber Dashboard | Risk score, findings, high-risk apps, score history, AI insight explainer |
| 📂 File Scanner | Scan APK files via SAF — structure, entropy, hashes, signatures |
| 🔐 Vault | AES-encrypted local storage for scan artifacts |
| 🧭 Signal-Net Detection | Droppers, packed DEX, decoy notification spoofing, a11y/overlay automation, hidelist abuse |
| 📈 Behavior & Usage Insights | Per-app network sockets, memory (PSS) telemetry, resource stats |
| 🇺🇸 Policy Presets | One-tap hardening profiles for your device posture |
| Layer | Tech |
|---|---|
| UI | Jetpack Compose (Material 3), Cyberpunk dark theme |
| Architecture | Multi-module Clean Architecture (:app · :core:domain · :core:detection · :core:data) |
| Persistence | Room (SQLite) with on-device learning memory |
| Background | WorkManager periodic scans, Accessibility overlay monitor |
| Build | AGP 9.3 · Kotlin 2.4.10 (built-in) · KSP · Compose BOM 2026.06 · Gradle 9.5 |
| SDK | compileSdk 37 · targetSdk 36 · minSdk 26 (Android 8+) |
| AI insight | Optional API keys (Groq/Gemini) — the only optional network touch, guarded behind secrets.properties |
DroidGuard/
├── app/ # Android shell: UI, scanning pipeline, install guard
│ └── src/main/assets/ # Offline threat DBs & YARA rule set (CSV)
├── core/
│ ├── domain/ # Pure models: signals, findings, reports, ML
│ ├── detection/ # Rules engine, YARA engine, APK/DEX/ELF forensics
│ └── data/ # PackageManager, device signals, usage, sockets
├── gradle/libs.versions.toml # Single source of truth for dependencies
# Full green build: release APK + lint + all unit tests
./gradlew :app:assembleRelease :app:lintDebug \
:core:domain:testDebugUnitTest \
:core:detection:testDebugUnitTest \
:core:data:testDebugUnitTestRequires: JDK 17+, Android SDK Platform 37, license accepted for
android-sdk-license.
Optional AI insight keys (build only, never committed):
# secrets.properties (repo root — gitignored)
groqApiKey=your_groq_key
geminiApiKey=your_gemini_keyIf keys are absent the app ships fully working; the AI-insight panel shows a friendly "not configured" state.
- 117 unit tests · 0 failures — rules engine, risk aggregator, hash utilities, entropy detector, YARA engine, deep APK forensics, ML classifier, score model, package repository mappers.
- Permission-drift timeline (silent update detection)
- Context-aware behavior graph
- Intent/URI export audit
- Stalkerware & app-cloner heuristics
- Forensic report export (STIX-flavored)
- Optional local LLM (100% offline insights)
- Root-optional process memory inspection
DroidGuard is a security tool, not a guarantee. It detects indicators, not intent. No detection layer is perfect — install apps only from trusted sources and keep system protections (Play Protect) enabled. DroidGuard is provided "AS IS" without warranty of any kind.