MANTABachelor thesis · 2026Thesis PDF

Interactive system demo

Use the app, then follow the decision.

This is a faithful browser reconstruction of the Android information architecture. It exposes the real protection, app inventory, alert-triage and privacy flows without requiring VPN permission.

Android endpointInteractive
MANTAMetadata-only endpoint monitor
Protection active◇

Monitoring network behaviour

Timing, volume and destination metadata are scored locally. Packet payloads are never inspected.

1,284flows today
3open alerts
0payloads read
Needs attentionOne high-confidence pattern
Runtime status
On-device modelAndroid RF · balancedReady
Privacy exportMedium · identifiers hashedOn
Server backendLast sync 14 seconds agoOnline
Decision trace

What happened to the traffic window

5 stages · 2 elevated signals · 0 payload reads
Packet metadata

TCP · outbound · 1,248 B · payload skipped

Flow attribution

org.telegram.messenger · destination hash 7b4…e91

Feature window

burst rate ↑ · destination novelty 0.91

Local inference

Android RF · anomaly score 0.82

Privacy export

Medium · app and endpoint identifiers hashed

Optional authenticated server dataPublic simulation

The token stays in this page state and is sent only to the same-origin server endpoint.

Captured

Flow metadata

Direction, duration, byte and packet counts, timing, protocol and destination-derived features.

Never captured

Payload content

Messages, passwords, images, files and application-layer bodies are outside the detection path.

Explicit limitation

Traffic analysis remains

Encryption and reduced export do not hide timing and volume patterns from the network observer.