GeDefense TV – local-first security console for Android TV / Google TV

On-device security console for Android TV OS and Google TV.

Local loopback VPN filtering, traffic map with geo attribution, XDR-Light and an honest status model.

No external VPN server. No cloud. No telemetry.

English · Deutsch · Русский · Français · 简体中文 · 日本語

GeDefense TV 0.2.0-alpha2 is an early alpha build. It is not a finished consumer product, not an audited security product, and the published APK is signed with a test signing key. Behaviour, UI and the filtering policy will change between alpha builds. Before you rely on it: understand the scope and limitations, read the release notes and treat every result as a hint, never as a guarantee.

Always use the latest release page: the exact APK asset, its checksums and the build notes live there. The alpha APK is test-signed — Android may warn when you sideload it. Verify the SHA-256 checksum against SHA256SUMS.txt or the checksums attached to the release before installing.

Real renders of the English UI, captured from a running Android TV emulator build (1920×1080, Android 16 Google TV / API 36).

The UI follows the TV system language. English is the default; German, French, Russian, Simplified Chinese and Japanese ship complete resource sets.

GeDefense TV is a D-pad-first security app for Android TV OS and Google TV. It combines a local filtering layer with a local observability console: it shows what the TV is doing on the network, what it blocked, which apps talk to which countries, and which findings are actually verifiable on the device.

The guiding rule is: only report what is observable on this specific device. Missing permissions, unsupported APIs or partial visibility are shown as partial visibility — never as proof that the TV is clean. A protection state is only claimed when a tunnel is actually active.

The app is a standalone TV app. It is not a router, firewall gateway or network sensor, and it does not integrate with router firmware.

GeDefense TV filters on the device itself. The app creates a local TUN interface, routes its own traffic through it and lets a vendored, audited data-plane helper evaluate DNS and connection metadata. The filtered traffic then leaves the device directly for its destination.

Local protection (loopback VPN)

On-device TUN service (VpnService, foreground service, Always-On support) with a vendored native helper for arm64-v8a and x86_64.

Start / stop with Android's one-time VPN consent; optional auto-start after app start.

Filter profiles: Off, Conservative, Balanced, Strict — each profile changes how aggressively known telemetry, ACR, ads, tracker and C2 destinations are treated.

Explicit state model: Off, Preparing, Active, Limited, Failed, Not supported. "Active" is only shown while the local tunnel really runs.

Live counters: blocked flows, observed apps, active flows and transferred volume since start.

Filtering: DNS, trackers, ACR, ads and C2

Local evaluation of DNS queries and connection destinations against the vendored threat index, a curated tracker/telemetry catalog, and the selectable privacy profile.

Actions are explainable: allow, annotate, correlate or block — with a reason from the local policy, never from a remote verdict.

Bounded threat-intelligence cache fed from public IOC lists; stale feeds are labelled, not hidden.

Honest limitation: if an app uses DNS-over-TLS/HTTPS, its domain names are not visible; the app says so instead of guessing.

Traffic map with local geo attribution

Per-app, per-country and per-domain aggregation of observed traffic: bytes, active flows, blocked flows, correlated flows.

World map with country markers and an origin marker derived from the TV region/network — no GPS, no location permission.

IP-to-country attribution uses an offline dataset downloaded once with SHA-256 checksums; country attribution is an estimate (CDNs, anycast and shared hosting can be misattributed).

Bounded, privacy-friendly data: no payloads, no screen content, no audio/video, no per-packet logs.

XDR-Light

Correlates what is locally observable into explainable incidents: repeated blocked flows per app, blocked telemetry/ACR traffic, first-seen app traffic, C2 feed matches and high-risk country corridors (informational only). Every incident carries its rule, confidence, visibility and a recommendation. Deduplicated, bounded, and explicitly not a privileged EDR: no system-wide flows, no process monitoring, no firmware integrity claims.

Deterministic, bounded sliding-window heuristics over observed outbound traffic: DNS bursts, destination fan-out, beacon patterns, volume spikes, repeated blocks, tracker categories, C2 matches and high-risk corridors. Every anomaly is a score with named signals — never a "malware" verdict.

Observe-only by default. Temporary containment is an explicit opt-in available only in the Strict profile. When enabled, only destination prefixes are contained (never apps), with strict guardrails: at least two independent signals, a minimum score, a known destination country, a short TTL (1–30 minutes, default 10), a maximum of four active containments, and allowlists for platform, Google and CDN ranges. Every containment is reversible: a TV popup appears, the user can press Undo, and the block lifts automatically when the TTL expires.

A six-step, D-pad-only setup wizard: welcome, how local protection works, VPN consent, threat-intel sync (skippable), first check, and a summary that activates full protection. Nothing is faked: if consent is denied or a step fails, the wizard says so.

A D-pad-safe overlay shows feed sync progress while public IOC feeds are updated. Stale or failed synchronisation is reported honestly and can be retried later.

Local evidence ledger with an HMAC-verified hash chain and encrypted payloads; fail-closed if the evidence key is lost instead of silently starting a new chain.

Local text and JSON security report.

Export through the system file picker (SAF); on TV images without a document picker the app uses a permission-free Downloads/GeDefenseTV fallback and tells the user where the files went.

Six languages, fully localised

English (default), German, French, Russian, Simplified Chinese and Japanese — complete resource sets for every UI string, checked by the repository translation checker.

Beyond filtering, GeDefense TV keeps the read-only audit surface that the product started with:

The status model is the product: capability and visibility are first-class data. Instead of a green "secure" badge, you get a posture score only when coverage is sufficient, explicit partial-visibility labels, and a clear statement of what could not be observed.

Android TV / Google TV (not rooted) ┌──────────────────────────────────────────────────────────────────────────┐ │ :app (normal app sandbox, no AndroidX, no third-party runtime libraries) │ │ UI (Views, D-pad) Protection Network XDR Onboarding Settings │ │ contracts / services │ │ │ │ │ TvVpnService (foreground service, local TUN) │ │ │ bounded control + telemetry │ │ ▼ │ │ GaiaNet helper (vendored native .so, child process, no root) │ │ DNS / flow policy → direct egress to the destination │ └──────────────────────────────────────────────────────────────────────────┘ :tv-core — pure JVM domain: scan, scoring, traffic, XDR, anomalies, containment policy, geo helpers, reports, events :core — vendored, byte-identical GeDefense Mobile core

Scope and limitations

GeDefense TV is intentionally not:

No telemetry, no analytics, no ads, no crash SDKs. The app contains no third-party runtime SDK.

No content capture: no screen, audio, video or payload capture; no TLS interception.

Local processing by default: traffic metadata, findings and evidence stay on the device.

Minimal permissions: INTERNET, ACCESS_NETWORK_STATE, FOREGROUND_SERVICE, FOREGROUND_SERVICE_SPECIAL_USE, POST_NOTIFICATIONS plus the BIND_VPN_SERVICE service permission. No location, accessibility, overlay, camera, microphone or QUERY_ALL_PACKAGES.

Only public data leaves the device: threat-intel feeds and an IP-to-country dataset are fetched over HTTPS; no device data is uploaded.

Security reporting: see SECURITY.md. Please do not publish exploitable details in public issues.

Full data inventory: PRIVACY.md · DATA-SAFETY.md. Security design and threat model: SECURITY.md · THREAT-MODEL.md.

Component Requirement

Device Android TV OS / Google TV, minSdk 26 (Android 8.0) or newer, arm64-v8a or x86_64

TV UI Leanback-compatible launcher, D-pad remote (no touch required)

Build JDK 17, Android SDK platform 36, Build-Tools 36.0.0, Gradle 8.7 (wrapper included)

Runtime dependencies none — no AndroidX, no third-party libraries

Install (sideload)

On the TV, allow installation from unknown sources for the app you use to install APKs (a sideload/file manager app, or ADB).

Install the APK from the latest release.

Start GeDefense TV, follow the onboarding and accept Android's one-time VPN consent dialog.

Optional, over ADB:

adb connect <tv-ip>:5555 adb install -r VGT_GeDefense_TV_0.2.0-alpha2_VC3_release-debugsigned.apk adb shell am start -n de.visiongaia.gedefense.tv/.TvMainActivity

The alpha APK is test-signed. A production signing key is not part of this alpha.

git clone https://github.com/visiongaiatechnology/gedefense_androidtv.git cd gedefense_androidtv

export JAVA_HOME=/path/to/jdk-17 export ANDROID_HOME=/path/to/android-sdk

./gradlew :app:assembleDebug # debug APK ./gradlew :app:assembleRelease # R8-minified release APK

Release signing reads GEDEFENSE_RELEASE_STORE_FILE, GEDEFENSE_RELEASE_STORE_PASSWORD, GEDEFENSE_RELEASE_KEY_ALIAS and GEDEFENSE_RELEASE_KEY_PASSWORD from the environment. Without them the build falls back to the debug signing config — fine for alpha testing, not for distribution. More details: BUILD-RUNBOOK.md.

./gradlew :tv-core:tvCoreCheck # core domain harness ./gradlew :tv-core:tvV2Check # traffic / privacy / XDR domain harness ./gradlew :tv-core:tvKineticCheck # V2.1 anomaly + containment harness ./gradlew :app:lintDebug # Android lint

The vendored core harness (:core:coreCheck) needs a Linux/macOS JVM: its durable-file code uses directory fsync, which is not supported on Windows. The Android TV emulator guide, including commands to create an AVD and capture screenshots, is in docs/TV-EMULATOR-TESTING.md. The acceptance matrix is TEST-PLAN.md.

. ├── app/ Android TV application module (Views, no AndroidX) │ └── src/main/ java/ · res/ (6 locales) · assets/ · jniLibs/ · AndroidManifest.xml ├── core/ vendored, byte-identical GeDefense Mobile core (pure JVM) ├── tv-core/ pure JVM domain: scan, scoring, traffic, XDR, anomalies, reports ├── docs/ architecture, traffic map, onboarding, design DNA, emulator guide, │ screenshots/ and assets/ ├── tools/ build/test/emulator/remote/verification scripts ├── gradle/ + gradlew* Gradle 8.7 wrapper (distribution SHA-256 pinned) ├── build.gradle.kts AGP 8.5.2 · Kotlin 1.9.24 · Java 17 └── settings.gradle.kts modules :core, :tv-core, :app

Documentation

Document Content

ARCHITECTURE.md Module graph, data flow, collectors, evidence, performance budgets

docs/V2-ARCHITECTURE.md Loopback VPN, telemetry, traffic aggregation, native helper supply chain

docs/TRAFFIC-MAP.md Traffic map data sources, limits, colors and privacy

docs/ONBOARDING.md First-run wizard, consent and permission explanations

docs/DESIGN-DNA.md TV design system, focus/interaction rules, forbidden patterns

SECURITY.md Security design, key custody, permissions, reporting policy

THREAT-MODEL.md Assets, trust boundaries, STRIDE analysis, TV-specific risks

PRIVACY.md Data inventory, retention, export, permissions rationale

TEST-PLAN.md Acceptance matrix and evidence requirements

BUILD-RUNBOOK.md Build, signing, logs and troubleshooting

docs/TV-EMULATOR-TESTING.md Step-by-step Android TV emulator guide

docs/SOURCES.md Sources and references

RELEASE-NOTES.md What changed in this alpha and its verification status

License and third-party notices