For Android, detect Encrypted Channel from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes high-entropy blob (Shannon entropy > $EntropyThreshold$) to local staging path immediately before outbound transmission — encrypted staging artifact confirms app-layer encryption occurred]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| Application State (DC0123) | android:EMM | Managed package inventory/status and package metadata |
| File Creation (DC0039) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes high-entropy blob (Shannon entropy > $EntropyThreshold$) to local staging path immediately before outbound transmission — encrypted staging artifact confirms app-layer encryption occurred |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: App invokes cryptographic functions (javax.crypto.Cipher, Android KeyStore, AES/RSA/ECC operations) on data buffer followed by encode-then-transmit sequence NOT matching app declared network function — app-layer crypto on data before transm |
| Field | Description |
|---|---|
| ApprovedCryptoApps | VPN clients, enterprise secure messaging (Signal, approved messaging), MDM agent, encryption-declared apps. Derive from MDM catalog. |
| EntropyThreshold | Default 7.0 bits Shannon entropy for staged file. Calibrate from legitimate app file baseline. Files above threshold are likely encrypted or compressed. |
| AppCDNList | 30-day per-app network destination baseline. |
| InteractionThreshold | Default 300s. |
Indirect evidence of application-layer encrypted channel usage inferred through anomalous background processing and network transmission patterns following application activity, where encryption operations are not directly observable. Detection correlates background execution + network behavior + application entitlement posture to identify misuse of encrypted communication channels.
| Field | Description |
|---|---|
| TimeWindow | Correlation window between background processing and network transmission |
| AllowedAppList | Apps expected to use encrypted communication channels |
| EntropyThreshold | Threshold for identifying encoded/encrypted payloads |
| BeaconIntervalVariance | Tolerance for periodic communication patterns |