For Android, detect Network Denial of Service by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ConnectivityManager, TelephonyManager, or WifiManager framework callbacks report repeated failure, disable, or oscillation events outside expected coverage-transition pattern]; Protected Configuration via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: ConnectivityManager, TelephonyManager, or WifiManager framework callbacks report repeated failure, disable, or oscillation events outside expected coverage-transition pattern |
| Protected Configuration (DC0115) | android:DevicePolicyManager | DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported |
| System Settings (DC0118) | android:DevicePolicyManager | DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported |
| Field | Description |
|---|---|
| TimeWindow | Maximum span for correlating connectivity degradation, application retry behavior, and network-session failure into a single denial event. |
| ExpectedMobilityPopulation | Users or device populations expected to move through low-coverage zones or transit environments that naturally cause network oscillation. |
| AllowedAppList | Apps expected to generate frequent retry behavior or maintain persistent sessions under ordinary weak-signal conditions. |
| ForegroundStateRequired | Whether impacted applications are expected to be actively visible to the user for the analytic to carry high confidence. |
| RecentUserInteractionWindow | Time threshold for determining whether connectivity degradation occurred during active device use versus idle background operation. |
| FailureBurstThreshold | Threshold for repeated disconnects, resets, DNS failures, or transport failures within the correlation window. |
| LocationProviderDependencyList | Apps or services expected to rely on GPS or network-based location and therefore likely to exhibit secondary degradation during jamming. |
| ExpectedCoverageZones | Known sites or geographies with weak legitimate coverage that should be baseline-adjusted. |
For iOS, detect Network Denial of Service from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Protected Configuration via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; System Settings via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application State (DC0123) | iOS:MDM | InstalledApplicationList / ManagedApplicationList |
| Protected Configuration (DC0115) | iOS:MDM | DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries |
| System Settings (DC0118) | iOS:MDM | DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries |
| Field | Description |
|---|---|
| TimeWindow | Maximum span for correlating app activity, posture stability, and repeated network failure into a single denial event. |
| SupervisedOnly | Whether the analytic should only apply to supervised devices with high-confidence MDM policy telemetry. |
| AllowedAppList | Apps expected to retry aggressively or queue offline work during routine coverage degradation. |
| ForegroundStateRequired | Whether the app should be foreground or recently active for the analytic to be treated as high confidence. |
| RecentUserInteractionWindow | Time threshold for determining whether the denial occurred during active user use versus background idle periods. |
| FailureBurstThreshold | Threshold for repeated session failures, resets, timeouts, or DNS failures within the correlation window. |
| ExpectedCoverageZones | Known sites or geographies where benign poor service should be baseline-adjusted. |
| TrustedDestinationAllowList | Expected enterprise destinations whose temporary maintenance or outage should not be treated as device-targeted denial. |