Threat Detection Engine

Relevant source files

The following files were used as context for generating this wiki page:

• app/src/main/kotlin/com/shadowcheck/mobile/domain/model/ThreatDetection.kt
• app/src/main/kotlin/com/shadowcheck/mobile/domain/model/ThreatType.kt
• app/src/main/kotlin/com/shadowcheck/mobile/domain/model/ThreatSeverity.kt
• app/src/main/kotlin/com/shadowcheck/mobile/domain/model/SurveillanceDetector.kt
• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/ThreatDetectionScreen.kt
• app/src/main/kotlin/com/shadowcheck/mobile/service/NetworkMonitorService.kt
• app/src/main/kotlin/com/shadowcheck/mobile/ui/screens/security/RogueAPScreen.kt

The Threat Detection Engine is a core component of the ShadowCheckMobile platform designed to identify, categorize, and alert users to potential network security risks and surveillance activities. It operates by analyzing real-time data from WiFi networks, Bluetooth devices, and cellular towers to detect anomalies such as IMSI catchers, rogue access points, and deauthentication attacks.

Sources: README.md, app/src/main/kotlin/com/shadowcheck/mobile/domain/model/SurveillanceDetector.kt:11-25

Core Architecture and Data Flow

The engine utilizes a multi-layered approach to detection, processing environmental data through specialized heuristic modules. Data is primarily ingested from background scanning services and compared against known malicious patterns or suspicious signal behaviors.

Threat Detection Pipeline

The following diagram illustrates the flow from data collection to threat reporting:

The engine aggregates findings from individual detectors into a prioritized list based on severity and confidence levels.
Sources: app/src/main/kotlin/com/shadowcheck/mobile/domain/model/SurveillanceDetector.kt:13-25, app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/ThreatDetectionScreen.kt:133-145

Detection Mechanisms

WiFi-Based Detection

The engine performs deep analysis on WiFi networks to identify spoofing and interference attempts.

• Evil Twin Detection: Identifies multiple access points (BSSIDs) broadcasting the exact same SSID, which is a common indicator of a phishing or man-in-the-middle setup.
• Deauthentication (Deauth) Attacks: Monitored via the NetworkMonitorService, which tracks DEAUTH_LEAVING or DEAUTH_DISASSOC reason codes in WiFi disconnection events.
• Rogue AP Identifiers: Scans for specific vendor OUIs (e.g., 00:00:00) or common malicious SSIDs like "Pineapple" or "attwifi".

Sources: app/src/main/kotlin/com/shadowcheck/mobile/domain/model/SurveillanceDetector.kt:59-78, app/src/main/kotlin/com/shadowcheck/mobile/service/NetworkMonitorService.kt:113-125, app/src/main/kotlin/com/shadowcheck/mobile/ui/screens/security/RogueAPScreen.kt:138-160

Cellular and Bluetooth Surveillance

The engine extends its scope beyond WiFi to include mobile network and short-range wireless monitoring.

• IMSI Catcher (Stingray): Detected by identifying multiple cell towers appearing at the exact same GPS location or observing abnormally high signal strength (e.g., > -50 dBm).
• Tracking Beacons: Identifies BLE devices with strong RSSI values that may indicate hardware used for proximity tracking.
• GPS Jamming: Inferred when valid WiFi/Cellular networks are visible but the system is unable to acquire a GPS lock.

Sources: app/src/main/kotlin/com/shadowcheck/mobile/domain/model/SurveillanceDetector.kt:31-57, app/src/main/kotlin/com/shadowcheck/mobile/domain/model/SurveillanceDetector.kt:123-138

Data Models

The engine uses standardized models to communicate findings to the UI layer.

Threat Categories

Threat Type	Description	File
IMSI_CATCHER	Potential Stingray or fake cell tower	ThreatType.kt:8
ROGUE_AP	Malicious or unauthorized access point	ThreatType.kt:4
EVIL_TWIN	SSID spoofing for credential harvesting	ThreatType.kt:5
DEAUTH_ATTACK	Active disconnection of wireless clients	ThreatType.kt:6
GPS_JAMMER	Signal interference preventing location lock	ThreatType.kt:11
HIDDEN_CAMERA	Detection of WiFi-enabled surveillance cameras	ThreatType.kt:10

Severity Levels

Threats are classified into four severity levels to help users prioritize response:

• CRITICAL: Immediate danger (e.g., Active IMSI Catcher).
• HIGH: Likely malicious activity (e.g., Evil Twin).
• MEDIUM: Suspicious behavior (e.g., Hidden network with high signal).
• LOW: Informational anomalies (e.g., High device density).

Sources: app/src/main/kotlin/com/shadowcheck/mobile/domain/model/ThreatSeverity.kt:3-9, app/src/main/kotlin/com/shadowcheck/mobile/domain/model/ThreatDetection.kt:3-12

Implementation Details

The detectThreats function in the UI layer demonstrates the logic used to generate alerts from the local database:

// Example: Detecting Hidden Networks as threats
networks.filter { it.ssid.isBlank() }.forEach { network ->
    threats.add(Threat(
        id = network.bssid,
        type = "Hidden Network",
        severity = "Medium",
        title = "Hidden SSID Detected",
        description = "Network broadcasting without SSID - potential surveillance",
        timestamp = network.timestamp,
        bssid = network.bssid
    ))
}

Sources: app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/ThreatDetectionScreen.kt:145-155

Conclusion

The Threat Detection Engine provides a comprehensive security layer for ShadowCheckMobile by correlating cross-protocol radio data. By focusing on signal strength anomalies, identity duplication, and known hardware signatures, it allows for the detection of sophisticated surveillance tools that would otherwise remain invisible to standard mobile OS security.