ThreatPlanet AI: The Open-Source Android Malware Hunter That Thinks Like a Security Expert
How one developer combined Machine Learning, YARA Rules, MITRE ATT&CK, and VirusTotal into a single adaptive threat detection framework — and hit 98.8% accuracy doing it.
Android malware doesn’t knock. It doesn’t announce itself. It slips into a device through a sideloaded APK, quietly requests a few permissions, and begins its work — exfiltrating contacts, intercepting messages, or silently enrolling the device into a botnet. By the time most traditional antivirus tools catch on, the damage is done.
That’s the problem ThreatPlanet AI was built to solve.
Created by Saketh Reddy, a Cyber Security Analyst and eJPT-certified Android malware researcher, ThreatPlanet AI is an open-source adaptive malware detection framework that doesn’t just scan APK files — it understands them. It layers behavioral analytics, machine learning classification, threat intelligence enrichment, and MITRE ATT&CK mapping into a unified analysis pipeline that delivers results in the kind of structured, actionable report a senior threat analyst would be proud to sign off on.
Let’s break down what makes this project remarkable.
The Problem With Traditional Android Malware Detection
Most antivirus tools rely heavily on signature-based detection — they compare a file’s hash or byte patterns against a known database of malicious samples. It works well for yesterday’s threats. But malware authors know this. They obfuscate code, repackage applications, and rename classes. A slightly modified APK sails right through signature scanners without raising a single flag.
What security teams actually need is a system that asks deeper questions:
- What permissions does this app request, and are they suspicious in combination?
- Does its code contain patterns associated with known malware families?
- What MITRE ATT&CK techniques does its behavior map to?
- Has VirusTotal seen this file before?
- What does a trained ML model say about its feature profile?
ThreatPlanet AI answers every one of these questions in a single automated pipeline.
Inside the Architecture: A Pipeline Built for Depth
The framework’s architecture is elegantly linear, yet each stage adds a meaningful layer of intelligence:
APK Upload
↓
Static Analysis Engine
↓
Permission Analysis
↓
YARA Detection
↓
MITRE ATT&CK Mapping
↓
Threat Intelligence
↓
VirusTotal Lookup
↓
Machine Learning Classifier
↓
Risk Scoring Engine
↓
JSON / PDF Reports
↓
React DashboardThis isn’t a checklist of features bolted together — it’s a thought-through kill chain of analysis, designed to catch what individual tools miss.
Feature Deep Dive: What ThreatPlanet AI Actually Does
1. APK Static Analysis with Androguard
At the heart of the system is Androguard, a powerful Python library for reverse-engineering Android applications. The static analysis engine dissects the APK’s internals — its Dalvik bytecode, class structures, strings, and embedded resources — without ever executing the application. This is crucial: you learn everything you need to know about a threat without letting it run.
2. Android Manifest & Permission Analysis
The AndroidManifest.xml file is the skeleton key of any Android app. It declares what the app is and what it's allowed to do. ThreatPlanet AI parses this manifest deeply, flagging dangerous permission combinations — things like READ_SMS paired with INTERNET and READ_CONTACTS, which together paint a picture of a data-harvesting trojan rather than a legitimate messaging utility.
3. YARA Rule Scanning
YARA is the industry standard for pattern-based malware classification. Security researchers write YARA rules to describe the characteristics of malware families — specific byte sequences, string patterns, structural indicators. ThreatPlanet AI’s rules/ module applies a curated set of these rules against each APK, flagging matches with precision. It's the equivalent of giving the scanner an expert's notebook of what to look for.
4. Dynamic Indicator Detection
Beyond static patterns, the framework hunts for behavioral indicators — the kind of code patterns that suggest what an application intends to do at runtime, even before it runs. Suspicious API calls, hidden execution paths, network communication patterns — these dynamic indicators betray a malicious app’s true nature.
5. MITRE ATT&CK Mapping
This is where ThreatPlanet AI goes from a scanning tool to a threat intelligence platform. The MITRE ATT&CK framework is the globally recognized knowledge base of adversary tactics, techniques, and procedures (TTPs). By mapping detected behaviors to ATT&CK techniques, ThreatPlanet AI tells analysts not just that something is malicious, but how the adversary is operating — which matters enormously for containment, attribution, and defense strategy.
An analyst reading a ThreatPlanet report doesn’t just see “suspicious” — they see “T1418: Software Discovery” or “T1432: Access Contact List,” giving them the vocabulary and context to act.
6. VirusTotal Integration
No analysis pipeline in 2025 is complete without VirusTotal. ThreatPlanet AI integrates directly with the VirusTotal API, cross-referencing each APK hash against VirusTotal’s database of 70+ antivirus engines. What would take an analyst several minutes of manual lookup happens automatically, embedded directly in the report.
7. Machine Learning Classification with 98.8% Accuracy
Here’s where things get genuinely impressive. ThreatPlanet AI trains a Random Forest classifier on the Drebin Android Malware Dataset — one of the most widely cited academic datasets in Android security research. The results speak for themselves:
MetricScoreAccuracy98.80%Precision99.09%Recall97.66%F1 Score98.37%
Get Akkamgarisakethreddy’s stories in your inbox
Join Medium for free to get updates from this writer.
These aren’t toy numbers. A 98.8% accuracy rate on the Drebin dataset, combined with a precision of over 99%, means the model is making very few false positives — critical in production environments where alert fatigue is a real operational problem.
8. AI-Generated Malware Summary
Beyond raw scores and classifications, ThreatPlanet AI generates a human-readable AI-powered malware summary — a natural language explanation of what was found, what it means, and why it matters. This bridges the gap between raw technical output and actionable intelligence for stakeholders who need to make decisions, not parse JSON.
9. Dual-Format Reporting: JSON + PDF
Every analysis produces two artifacts:
- A JSON report for downstream tooling, SIEM integration, or programmatic consumption.
- A PDF report for sharing with teams, clients, or incident response stakeholders.
This dual-format approach acknowledges the realities of security operations: machines need structured data, humans need readable documents.
10. Interactive React Dashboard
The entire pipeline surfaces through a clean React + Vite frontend — a dashboard where analysts can upload APKs, watch the analysis pipeline run, and explore results interactively. Risk scores, VirusTotal verdicts, malware family identifications, MITRE technique mappings, ML predictions — all visible in one place.
The Technology Stack: Thoughtfully Chosen
LayerTechnologyBackendPython, FastAPI, Androguard, SQLite, ReportLabFrontendReact, Vite, AxiosDetectionVirusTotal API, YARA, MITRE ATT&CKMLScikit-Learn, Random Forest, Drebin Dataset
The stack is deliberately practical. FastAPI is blazing fast and excellent for API-first backends. Androguard is the gold standard for Android binary analysis. Scikit-Learn’s Random Forest is interpretable, fast to train, and well-understood — a responsible choice for a security-critical application where explainability matters. The frontend uses Vite for near-instant build times. Nothing here is chosen for novelty; everything is chosen because it’s the right tool for the job.
Why This Project Matters
The mobile threat landscape is not slowing down. Android, with its open ecosystem and allowance for sideloading, remains the primary target for mobile malware campaigns. Sophisticated threat actors, nation-state APT groups, and opportunistic cybercriminals all target Android devices — and their tools are evolving faster than most defensive capabilities.
ThreatPlanet AI represents exactly the kind of layered defense security researchers and practitioners advocate for:
- Signature + Behavior: YARA rules catch known patterns; behavioral indicators catch novel techniques.
- Static + Intelligence: Static analysis is enriched by real-world threat intelligence from VirusTotal.
- Rule-based + ML: Deterministic detection is augmented by probabilistic machine learning.
- Technical + Human-readable: Raw data is transformed into reports that drive decisions.
No single layer is sufficient. All of them together form a detection system that is genuinely hard to evade.
Getting Started
ThreatPlanet AI is open source and designed to be straightforward to self-host:
bash
# Clone the repository
git clone https://github.com/SakethReddy-07/threatplanet-ai.git
cd threatplanet-ai# Set up a virtual environment and install dependencies
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt# Configure your VirusTotal API key
echo "VT_API_KEY=your_api_key_here" > .env# Start the backend
python -m uvicorn backend.app.main:app --reload# In a separate terminal, start the frontend
cd frontend && npm install && npm run dev
Then navigate to http://localhost:5173, upload an APK, and let ThreatPlanet AI do its work.
To train the ML model on the Drebin dataset:
bash
python ml/train_model.py
python ml/save_features.pyFinal Thoughts: Security Engineering at Its Best
What impresses me most about ThreatPlanet AI isn’t any single feature — it’s the coherence of the system. Every component reinforces the others. The ML model’s prediction is more credible because it’s backed by YARA rule matches. The MITRE ATT&CK mapping is more actionable because it’s paired with a human-readable AI summary. The PDF report is more useful because it aggregates VirusTotal verdicts, risk scores, and family identifications in one place.
This is what good security engineering looks like: not a collection of disconnected tools, but an integrated system where the whole is genuinely greater than the sum of its parts.
Saketh Reddy has built something that would be valuable in a SOC, useful in academic research, and instructive for any security practitioner who wants to understand how modern Android malware analysis actually works. The fact that it’s open source makes it even more significant.
If you work in mobile security, threat intelligence, or Android app analysis — this project deserves a place in your toolkit.
GitHub Repository: github.com/SakethReddy-07/threatplanet-ai
Author: Saketh Reddy — Cyber Security Analyst | eJPT Certified | Android Malware Researcher
Found this useful? Follow for more deep-dives into open-source security tools, malware analysis frameworks, and applied machine learning in cybersecurity.
Tags: Android Security Malware Analysis Machine Learning Cybersecurity Open Source MITRE ATT&CK Threat Intelligence Python YARA
