SetuGuard
Static Android malware analysis and mule-account scoring for a public-sector banking security programme.
"Scans banking apps for security flaws and writes verified detection rules — no made-up evidence."
What it is
Built a static APK analyser for a public-sector banking security programme. It was measured against a corpus of real Indian banking apps assembled after the scoring terms were chosen, so the measurement was uncontaminated.
What was hard
It scored real banks as more dangerous than malware. The reason was structural: banking apps and banking trojans request the same permissions and touch the same sensitive APIs by construction, so a permission-and-API feature set measures whether an app handles money, not whether it’s hostile.
What was measured
The system was rescoped to evidence extraction, MITRE-mapped IOC reporting, and YARA generation, with an upstream allowlist for Play-signed banking packages. The jury’s stated reason for the loss was that the build didn’t deliver the real-time analysis both problem statements asked for, which is the same conclusion the measurement pointed at.
What is still open
The page still needs a production deployment path and a cleaner split between static analysis results and runtime analysis claims.
Empirical Claims & Verification Invariants
| statement | value | sample | status | provenance |
|---|---|---|---|---|
| Detector ranks legitimate Indian banking apps above known malware. | 0.1444 0.0905–0.2081, point 0.1444 | 51 packages, 32 issuer clusters | Measured | corpus snapshot and evaluation notebook |
| Same measurement on an era-matched subset. | 0.3190 0.2202–0.429, point 0.319 | 20 packages, 16 clusters | Measured | subset evaluation notebook |
| Mule-account model precision-recall on repeated holdout splits. | median 0.271, IQR 0.221–0.362 | 20 seeds, 16 positives per holdout | Measured | repeated holdout evaluation |
| Fraud caught in the top 5% of scored accounts. | median 53.1%, IQR 43.8–62.5 | 20 seeds | Measured | repeated holdout evaluation |
| Static analysis parses real banking APKs without failure. | 0 of 73 strict; 2 of 73 including 600s timeouts | 73 APKs, one host | Measured | parser stress test |
| Peak resident memory on the largest APK analysed. | 12,272 MB on a 251 MB APK | single host, parallelism 1 | Measured | resource profiling run |
| Malicious APKs yielding at least one network host indicator. | 66.9% (241 of 360) | right-censored at 25 indicators | Measured | IOC extraction audit |
| Assigned features using the target label, so the uplift and the bridge claim were both leakage. | Invalid | review finding |