GraphiteShield_lab - Java 17 defensive-security workbench for synthetic

项目说明

GraphiteShield Lab

A local-only Ja workbench for defensi behavior emulation, detection engineering, triage, and e reporting.

![Java]()
![]()
![GraphiteShield CI]()
Synthetic telemetry · Detection rules · Finding triage · Risk scoring · CS · HTML in reports

---

O

GraphiteShield Lab is a self-contained desktop research en for safely demonstrating suspicious mobile-threat behavior and e defensi logic.

The application generates synthetic Android-style telemetry and identities inside a local Ja interface. Researchers can run controlled scenarios, inspect event streams, test detection rules, triage findings, measure session risk, and export e without connecting to a real phone or external service.

The core workflow is:

simulate → observe → detect → in → triage → report

GraphiteShield Lab is designed for:

It is intentionally not a spyware tool, exploitation framework, de utility, or real-device forensic collector.

---

Screenshot

<p align="center">
<img src="docs/images/graphiteshield-lab.png" alt="GraphiteShield Lab mobile threat detection research workbench" width="1000">
</p>

<p align="center">
<em>GraphiteShield Lab desktop research interface for synthetic telemetry, detections, experiments, rules, triage, and reporting.</em>
</p>

---

Try It in Two Minutes

Requirements

Windows

Double-click:

or from PowerShell:

macOS / Linux

Make the launcher executable once:

Then run:

Direct JAR Launch

The included launchers start the packaged JAR directly. No build process, package manager, external images, web services, or runtime downloads are required.

---

Suggested First Experiment

For a quick tour of the full analyst workflow:

1. Open Experiment Lab
2. Choose Combined ad intrusion simulation
3. Set playback speed to 2×
4. Click Run experiment
5. Open Li
6. Search and filter the generated events
7. Review findings under Detections
8. Acknowledge or close a finding
9. Open Detection Rules
10. Test a rule manually
11. Open Reports
12. Generate the HTML in report

That provides a complete end-to-end demonstration using synthetic data only.

---

What GraphiteShield Lab Demonstrates

GraphiteShield Lab combines multiple defensi workflows in one desktop application:

The project is intentionally designed around the defender's workflow, not attacker capability.

---

Main Capabilities

Experiment Lab

The application includes se experiment scenarios designed to generate suspicious-but-synthetic behavior patterns.

Experiments can be replayed at adjustable speed so analysts can observe how event sequences evolve over time.

The scenario system is useful for:

---

Li Telemetry

GraphiteShield Lab generates a li stream during experiments.

Analysts can:

All telemetry is generated locally by the simulator.

No real device events are collected.

---

Detection Rules

Detection logic can be re and tested inside the application.

The rule workflow supports defensi around suspicious behavior patterns without executing real malicious activity.

This allows a researcher to compare:

---

Finding Triage

Detected events are turned into analyst-re findings.

The application supports finding lifecycle actions including:

This makes GraphiteShield Lab useful for demonstrating the workflow around detection—not just generating alerts.

---

Risk Scoring

GraphiteShield Lab calculates session-level risk so experiment results can be as a larger in rather than only as indi events.

The dashboard provides a quick summary of the simulated en and current defensi.

Risk are demonstration aids and should not be interpreted as production threat scores.

---

Synthetic Device Profiles

The application includes multiple synthetic Android-style device profiles.

Profiles exist only to provide realistic context for experiments.

They do not correspond to or communicate with actual phones.

---

Reporting and E Export

CS Export

Generated telemetry can be exported to CSV for:

The generated telemetry export is intentionally ignored by Git through:

HTML In Report

GraphiteShield Lab can generate a styled HTML in report that summarizes the simulated session and analyst findings.

The generated report file is also excluded from source control:

This keeps generated analyst artifacts separate from application source.

---

Architecture

GraphiteShield Lab is intentionally self-contained.

No external device, server, API, or database is required for the included lab workflow.

---

Repository Layout

The repository currently includes both source and a directly runnable JAR so the project can be e without compiling it first.

---

Build From Source

GraphiteShield Lab is written in Java and targets Java 17 or newer.

From the repository root, a basic build can be performed with the JDK:

Run the compiled class:

To create an executable JAR manually:

On Windows Command Prompt, the same operations can be performed using the installed JDK's javac, java, and jar commands.

---

Technology

| Area | Implementation |
|---|---|
| Language | Java |
| Minimum runtime | Java 17 |
| Application type | Desktop |
| UI | Ja/Swing-style interface |
| Persistence | Local in-memory/session workflows |
| Telemetry | Synthetic/local |
| Reporting | CS HTML |
| External services | None required |
| Real-device integration | None |

---

Safety Model

GraphiteShield Lab is intentionally a defensi.

It does not:

Network addresses used in scenarios are documentation/test fixtures rather than operational infrastructure.

All identities, device information, telemetry, findings, and threat events are synthetic.

---

Why the Safety Boundary Matters

Mobile-threat research can easily become ambiguous if a demonstration tool interacts with real systems.

GraphiteShield Lab intentionally keeps the boundary clear:

There is no step that connects the simulator to a real target.

That makes the project appropriate for education, demonstrations, detection engineering, and controlled defensi.

---

Generated Files and Repository Hygiene

The current .gitignore excludes:

This keeps:

out of control.

---

Project Status

GraphiteShield Lab is a defensi portfolio and research project.

It currently demonstrates practical work across:

---

Current Limitations

GraphiteShield Lab is not intended to be a production mobile EDR, forensic suite, or commercial malware-analysis platform.

Current scope does not include:

These are deliberate boundaries unless the project e toward additional defensi research workflows.

---

License

GraphiteShield Lab is released under the MIT License.

---

Author

Daniel Fuhr

---

Why This Project Matters

GraphiteShield Lab demonstrates the intersection of software engineering, defensi, detection logic, analyst workflow design, and safety-conscious research tooling.

Rather than claiming to detect or interact with real spyware, the project creates a controlled en where suspicious behavior can be modeled, detected, in, and documented without exposing real devices, real users, or real data to risk.

That defensi workflow is the core of the project.

项目信息

开发语言：Java

Star 数：3

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Java 17 defensive-security workbench for synthetic mobile-threat emulation, detection engineering, analyst triage and local investigation reporting.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。