Back to catalog

Cybersecurity

2026-09-15

APKLens — Explainable Android Application Security & Forensic Analysis Platform

Enterprise-grade Android malware analysis, reverse engineering, and digital forensics platform with explainable 0–100 risk scoring, MITRE ATT&CK mapping, and automated YARA/STIX 2.1 intelligence generation.

Inspect Source Code

APKLens — Explainable Android Application Security & Forensic Analysis Platform Preview

The Problem

Analyzing suspicious Android applications requires complex, fragmented tools and risky sandbox environments. Incident responders, digital forensic examiners, and law enforcement need rapid, explainable risk scoring and court-ready evidence without detonating untrusted payloads on live devices.

The Solution

APKLens unifies static Dalvik bytecode inspection, native ELF (.so) binary analysis, and predictive runtime simulation into a single containerized platform. Every risk finding is strictly attributed to evidence mapped to MITRE ATT&CK® for Mobile, generating court-ready chain-of-custody affidavits, YARA rules, and STIX 2.1 bundles.

Key Capabilities

Static Deep-Inspection: Decompresses APKs safely with zip-bomb guards, parses binary AXML via Androguard, audits exported attack surfaces, and disassembles Dalvik bytecode.
Evidence-Based Behaviour Simulation: Predicts runtime payload drops, sensitive resource requests, and network endpoints with zero live execution risk.
Native Library (.so) ELF Audit: Deep-scans shared objects for dangerous syscalls (ptrace, mprotect, system), packed payloads, and hidden C2 endpoints.
Explainable 0–100 Risk Scoring: Category-capped scoring framework mapped to MITRE ATT&CK for Mobile and the Mobile Cyber Kill-Chain.
Court-Ready Forensic Reports: Generates tamper-evident SHA-256 Chain-of-Custody PDF reports, containment rules, automated YARA signatures, and OASIS STIX 2.1 bundles.
Production Containerization: Fully containerized with Docker & Docker Compose, tested across synthetic malware baselines and published APKs like F-Droid.

Technology Stack

Python 3.11FastAPIAndroguardReact 18TypeScriptViteTailwind CSSDockerYARASTIX 2.1

Forensic Analysis Workflow

APKLens operates through a multi-stage static and simulated pipeline:

[Target APK Upload]
         │
         ▼
[Decompression & Zip-Bomb Guard]
 ├── Binary AXML Parsing (Permissions, Exported Activities, Services)
 ├── Dalvik / Smali Bytecode Disassembly (Reflection, Dynamic DEX Loading)
 └── Native ELF (.so) Binary Audit (Dangerous Syscalls & C2 Extraction)
         │
         ▼
[Evidence Attribution & Threat Engine]
 ├── MITRE ATT&CK® for Mobile Mapping
 ├── 5-Phase Mobile Cyber Kill-Chain Tracking
 └── Explainable 0–100 Risk Score Synthesis
         │
         ▼
[Forensic Output: PDF Affidavit + STIX 2.1 Bundle + YARA Signatures]

Forensic Calibrations & Compliance

Synthetic Malware Baselines: Calibrated across clean utilities (0/Low), ad-supported grayware (43/Medium), and banking trojans (100/Critical).
Real-World Calibration: Tested on the official F-Droid client (12.5 MB, 3 DEX files, 4 native libraries) scanning in 2–4 seconds at an accurate 47/Medium without false critical alerts.
Standards Adherence: Compliant with OASIS STIX 2.1 threat intelligence standards and YARA binary rule specifications.

Lessons Learned & Key Takeaways

Engineered APKLens to prevent false positives by calibrating scoring against real published applications (like F-Droid) and implementing strict category score caps. Designed tamper-evident cryptographic hash chains for legal digital forensic admissibility.