Data Collectors
- 1. Overview
- 2. Collectors division
- 3. Collectors description
- 3.1 APPS_LIST
- 3.2 APPS_USAGE
- 3.3 APPS_USAGE (deprecated)
- 3.4 BATTERY
- 3.5 BLUETOOTH_COLLECTOR
- 3.6 BLUETOOTH_DEVICES_COLLECTOR
- 3.7 BROWSER
- 3.8 CALENDAR_EVENTS
- 3.9 CALL_LOG - deprecated
- 3.10 CPU_PROCESS
- 3.11 DICTIONARY
- 3.12 GEOLOCATION
- 3.13 HEADSET_PLUG
- 3.14 MEDIA_FILES
- 3.15 MEMORY_USEAGE
- 3.16 MESSAGE - deprecated
- 3.17 NETWORK_CONNECTION
- 3.18 NETWORK_USAGE
- 3.19 NFC_COLLECTOR
- 3.20 PACKAGE_CHANGE
- 3.21 PERMISSION_COLLECTOR
- 3.22 PHONE_INFO
- 3.23 PROFILE_MODE
- 3.24 ROAMING
- 3.25 SCREEN_ORIENTED
- 3.26 SIGNAL_STRENGTH
- 3.27 WIFI_DATA_CONNECTION
- 3.28 FACEBOOK_NETWORK_COLLECTOR
- 3.29 ROOT_COLLECTOR
- 3.30 MOVEMENT_COLLECTOR
- 3.31 USB_COLLECTOR
- 3.32 STANDBY_BUCKET_COLLECTOR
- 4.0 Default Collection interval
- 5. Collector json object names
- 6. Description of permissions
1. Overview
SDK gathering data constantly. Data collectors were divided into two groups:
- active - work only when user actively using application,
-pasive - work based on alarms (gather data when application stays in background)
The collected data is send to server with HTTP methods. Library saving mechanisms work based sharedpreferences and databases.
Every sent hit has a timestamp field (''ts'') synchronized with the server
2. Collectors division
Data collectors are divided into two groups. First group called active collectors due to Android system restrictions (android Oreo background limits) work only while application is currently in foreground. Full active colelctors list:
- PACKAGE CHANGE,
- BATTERY
- SIGNAL_STRENGTH
- PROFILE_MODE
- HEADSET_PLUG
- CPU_PROCESS (for Android below Nougat)
- GEOLOCATION (work also as passive collector)
- APPS_USAGE (for Android below Lollipop)
- ROAMING
- NETWORK_CONNECTION
- WIFI_DATA_CONNECTION
Other group called pasive collectors which based on alarm manager fire up on specific time intervals. Full passive collectors list:
- BATTERY
- MEMORY_USEAGE
- SCREEN_ORIENTED
- CPU_PROCESS
- PHONE_INFO
- GEOLOCATION (work also as active collector)
- APP_LIST
- APPS_USAGE
- BROWSER
- NETWORK_USEAGE
- DICTIONARY
- CALENDAR_EVENTS
- MEDIA_FILES
- NFC_COLLECTOR
- BLUETOOTH_COLLECTOR
- PERMISSION_COLLECTOR
- BLUETOOTH_DEVICES_COLLECTOR
- FACEBOOK_NETWORK_COLLECTOR
- ROOT_COLLECTOR
- MOVEMENT_COLLECTOR
- USB_COLLECTOR
- STANDBY_BUCKET
Duplicate collectors in both groups are not mistake. It is intended behaviour that help gather at most data and is forced by Android SDK versions or system restrictions.
3. Collectors description
3.1 APPS_LIST
- Explanation:
Collect all application's info on device.
- Required permissions:
none
- Optional permissions:
android.permission.GET_PACKAGE_SIZE (obligatory on Android SDK >= 23, Marshmallow 6.0) - allow to gather information about application size (sizeInfo json object)
android.permission.QUERY_ALL_PACKAGES (obligatory on Android SDK >= 30, Android 11) - allow to query packages other than Android system packeges and your own package - Variable description:
versionName - application version name
firstInstallTime - application install timestamp
launcher - got "good" intent to launch a front-door activity in a package
packageName - app package name
processName - app process name if packageName equals processname
versionCode - app version code
minSDK - application target version. It may run on earlier versions, but it knows how to work with any new behavior added at this version
largeheap - true when the application has requested a large heap for its processes
system - if set, this application is installed in the device's system image.
name - app user friendy name
uid - The kernel user-ID that has been assigned to this application; currently this is not a unique ID (multiple applications can have the same uid).
lastUpdateTime - The time at which the app was last updated
systemUpdated - this is set if this application has been installed as an update to a built-in system application
sizeInfo - json object with size information, on Marshmallow 6.0 present only with granted optional permission
externalcacheSize - Size of the external cache used by the application
dataSize - Size of the internal data size for the application
codeSize - Size of the code (e.g., APK)
externalDataSize - Size of the external data used by the application (e.g., /Android/data/ )
cacheSize - Size of cache used by the application. (e.g., /data/data/ /cache)
externalStorage - set to true if the application is currently installed on external/removable/unprotected storage
persistent - set to true if this application is persistent (whether or not the application should remain running at all times). Persistence mode is intended only for certain system applications.
disabled - indicates that all components within this application are considered disabled
externalCodeSize - size of the secure container on external storage holding the application's code
externalMediaSize - size of the external media size used by the application
externalObbSize - size of the package's OBBs placed on external media. OBB files are used to provide additional file assets for Android applications (such as graphics, sounds and video), separate from an application's APK file. - Example:
{
"ts": 1548677212017,
"appsList": [
{
"versionName": "14.03.53",
"firstInstallTime": 1230789600000,
"launcher": true,
"packageName": "com.google.android.youtube",
"processName": "com.google.android.youtube",
"versionCode": 1403533330,
"minSDK": 28,
"largeHeap": true,
"system": true,
"name": "YouTube",
"uid": 10093,
"externalStorage": false,
"persistent": false,
"disabled": false,
"sizeInfo": {
"externalCacheSize": 24576,
"dataSize": 552960,
"codeSize": 131072000,
"externalDataSize": 16384,
"externalCodeSize": 0,
"externalMediaSize": 0,
"externalObbSize": 0,
"cacheSize": 139264
},
"lastUpdateTime": 1548435339281,
"systemUpdated": true
}
]
}
3.2 APPS_USAGE
- Explanation:
Collect time active an application.The collector uses the class UsageStatsManager.
- Required permissions:
android.permission.PACKAGE_USAGE_STATS (obligatory on android sdk >= Lollipop 5.0)
android.permission.GET_TASKS (obligatory on android sdk <= Kitkat 4.4)
since Android 11 geting the data will also be possible only if the device is unlocked by the user. This desn't impact the active collector since it only works when app is in foreground.https://developer.android.com/reference/android/app/usage/UsageStatsManager.html#queryEvents(long,%20long)
- Optional permissions:
none - Variable description:
startTs - application start
duration - time of use in milliseconds
stopTs - application stop
package - application package
foreground - true if application was in foreground and screen was on, false otherwise
- Example:
{
"ts": 1557825443149,
"appsUsage2": {
"data": [
{
"duration": 38520,
"package": "spicymobile.sample2.mobience",
"stopTs": 1557825382397,
"startTs": 1557825343877,
"foreground": true
},
{
"duration": 62194,
"package": "spicymobile.sample2.mobience",
"stopTs": 1557825444591,
"startTs": 1557825382397,
"foreground": false
}
],
"startTs": 1557825443138,
"isFull": true
}
}
3.3 APPS_USAGE (deprecated)
- Explanation:
Obsolete collector sending data about application usage. Still in use by old and forgotten user applications.
- Required permissions:
none
- Optional permissions:
none
- Variable description:
data - array list of usage data
ms - time of use in milliseconds
name - package name or event
isFull - irrelevant
- Example:
Active collector hit (application has to work as foreground):
{
"appsUsage": {
"data": [
{
"ms": 2432288,
"name": "SCREEN_OFF"
},
{
"ms": 9823,
"name": "com.android.systemui"
},
{
"ms": 368060,
"name": "SCREEN_OFF"
}
],
"startTs": 1546371785061,
"isFull": true
},
"ts": 1546374594650
}
3.4 BATTERY
- Explanation:
BatteryInfoCollector collects battery info: level and charge event.
- Required permissions:
none
- Optional permissions:
none
- Variable description:
start - charging start time
source - charge source (USB or AC)
startTemp - temperature start charging
stop - charging stop time
startVol - voltage start charging
stopVol - voltage stop charging
stopTemp - temperature stop charging
startLv - battery level start charging
stopLv - battery level stop charging
level - battery level
- Example:
Active collector hit (application has to work as foreground):
{
"ts": 1548687066900,
"batteryInfo": {
"start": 1548686926256,
"source": "USB",
"startTemp": 296,
"stop": 1548687068108,
"startVol": 4352,
"stopVol": 4351,
"stopTemp": 297,
"startLv": 100,
"stopLv": 100
}
}
Pasive collector hit (periodically broadcast alarm):
{
"ts": 1567146572282,
"batteryInfo": {
"level": 100
}
}
3.5 BLUETOOTH_COLLECTOR
- Explanation:
Bluetooth collector collects information of Bluetooth, Bluetooth LE (for android >= Jelly Bean 4.1) function of
that device, contains normal Bluetooth information.
- Required permissions:
none
- Optional permissions:
android.permission.BLUETOOTH
- Variable description:
isSupported - is bluetooth or Bluetooth LE supported
isEnabled - is bluetooth or Bluetooth LE enabled (required by optional permission)
- Example:
{
"ts": 1548746645461,
"bluetoothInfo": {
"bluetooth": {
"isSupported": true,
"isEnabled": false
},
"bluetoothLE": {
"isSupported": true,
"isEnabled": false
}
}
}
3.6 BLUETOOTH_DEVICES_COLLECTOR
- Explanation:
Bluetooth collector collects information of new devices connected via Bluetooth.
- Required permissions:
android.permission.BLUETOOTH
- Optional permissions:
none
- Variable description:
connected - true if new device connected, false otherwise
ts - connected/disconnected timestamp
device_name - friendly Bluetooth name of the remote device
device_address - hardware address of this BluetoothDevice
- Example:
{
"ts": 1548753718500,
"bluetoothConnectedDevice": {
"connected": "",
"device_name": "",
"device_address": "",
"ts": 129387329479
}
}
3.7 BROWSER
- Explanation:
Collecting data on browser history, bookmarks, phrases. Gathering bookmarks is not possibly since we use accessibility service.
- Required permissions:
com.android.browser.permission.READ_HISTORY_BOOKMARKS (Removed since android sdk >= Marshmallow 6.0) on Android api level < Lollipop 5.0
turned on accessibility for application on Android api level >= Lollipop 5.0
- Optional permissions:
none
- Variable description:
visited - visit timestamp
visitedLocTs - true if ''visited'' timestamp is device local
visits - number of visits
title - site title
created - creation timestamp
createdLocTs - true if ''created'' is device local
url - site url
type - bookmark type
- Example:
{
"ts": 1548753718500,
"browserHistory": {
"spicymobile.sample2.mobience.browser": [
{
"visited": 1548753703258,
"visits": 1,
"title": "",
"created": 1548753703258,
"url": "https://m.onet.pl"
},
{
"visited": 1548753710321,
"visits": 1,
"title": "",
"created": 1548753710321,
"url": "Wirtualna Polska - Wszystko co ważne - www.wp.pl"
}
]
},
"browserBookmarks": {
"browser": [
{
"visited": 1568032189945,
"visits": 2,
"title": "Meczyki.pl - Mecze na żywo, mecze online, sport live",
"url": "https://www.meczyki.pl/",
"created": 32874623949324,
"type": 2
},
{
"visits": 0,
"title": "Picasa",
"url": "http://picasaweb.google.com/"
}
]
},
"browserPhrases": {
"pl.meonmobile.searchplaces.browser": {
"1567588171303": "mecz polski"
}
}
}
3.8 CALENDAR_EVENTS
- Explanation:
Collects calendar events data of a device, with a range of days : before 100 days and after 100
days with the collecting dayRequired permissions.
- Required permissions:
Manifest.permission.READ_CALENDAR
- Optional permissions:
none
- Variable description:
eventConfirmed - json array with confirmed events
eventTentative - json array with tentative events
eventCanceled - json array with canceled events
start - start event timestamp
title - event title
location - event location
startDay - event start day
endDay - event end day
alarm - use alarm true, false otherwise
end - end timestamp
timezone - timezone
- Example:
{
"ts": 1548756439048,
"calendarEvent": {
"eventConfirmed": [
{
"start": 1546214400000,
"title": "Sylwester (święto)",
"location": "",
"startDay": 1546214400000,
"endDay": 1546300800000,
"alarm": false,
"end": 1546300800000,
"timezone": "UTC"
},
{
"start": 1548930600000,
"title": "Kolejny test",
"location": "",
"startDay": 1548930600000,
"endDay": 1548934200000,
"alarm": true,
"end": 1548934200000,
"timezone": "Europe/Warsaw"
}
]
}
}
3.9 CALL_LOG - deprecated
- Explanation:
Collect all data history from phone call log. Due to new Google policy changes we can't collect call informations. Read more here
- Required permissions:
Manifest.permission.READ_CALL_LOG
- Optional permissions:
none
- Variable description:
incoming - incoming phone call
outgoing - outgoing phone call
misscall - missed call
voicemail - voice mail
rejected - rejected call
refused - refused call
date - call date
seconds - call duration
- Example:
{
"ts": 1550049621866,
"callLogData": {
"incoming": [
{
"date": "",
"seconds": ""
}
],
"misscall": [
{
"date": "",
"seconds": ""
}
],
"rejected": [
{
"date": ""
}
],
"refused": [
{
"date": ""
}
],
"outgoing": [
{
"date": "",
"seconds": ""
}
],
"voicemail": [
{
"date": "",
"seconds": ""
}
]
}
}
3.10 CPU_PROCESS
- Explanation:
Collect process running cpu on device at time request. Works on android sdk < Nougat 7.0 (since Nougat, application just see it own process).
- Required permissions:
none
- Optional permissions:
none
- Variable description:
cpu_freq - cpu check frequency from configuration file
cpu_period - cpu send period from configuration file
frequency - cpu send frequency from configuration file
processRunning - json array with processes
name - process name
cpu_min - cpu min
cpu_max - cpu max
cpu_median - cpu median
cpu_average - cpu average
residentMemory_min - resident memory min
residentMemory_max - resident memory max
residentMemory_average - resident memory average
residentMemory_median - process resident set size median
virtualMemory_min - process virtual memory min
virtualMemory_max - process virtual memory max
virtualMemory_median - process virtual memory median
virtualMemory_average - process virtual memory average
ts - current time
- Example:
{
"ts": 1550049621866,
"cpuProcess": {
"ts": 1550049622189,
"cpu_freq": 10800,
"processRunning": [
{
"residentMemory_median": 23688,
"cpu_average": 0,
"cpu_max": 0,
"residentMemory_max": 23688,
"virtualMemory_min": 645076,
"name": "com.google.android.partnersetup",
"virtualMemory_average": 645076,
"virtualMemory_median": 645076,
"cpu_median": 0,
"residentMemory_average": 23688,
"residentMemory_min": 23688,
"virtualMemory_max": 645076,
"cpu_min": 0
},
{
"residentMemory_median": 29724,
"cpu_average": 0,
"cpu_max": 0,
"residentMemory_max": 29724,
"virtualMemory_min": 646644,
"name": "com.google.android.packageinstaller",
"virtualMemory_average": 646644,
"virtualMemory_median": 646644,
"cpu_median": 0,
"residentMemory_average": 29724,
"residentMemory_min": 29724,
"virtualMemory_max": 646644,
"cpu_min": 0
}
],
"cpu_period": 30,
"frequency": 30
}
}
3.11 DICTIONARY
- Explanation:
Collect all data Dictionary of user on device. We cannot access Dictionary from Android sdk >= Marshmallow 6.0.
- Required permissions:
android.permission.READ_USER_DICTIONARY
- Optional permissions:
none
- Variable description:
freq - The frequency column. A value between 1 and 255. Higher values imply higher frequency
shortcut - shortcut explanation
word - added word
locale - country locale
- Example:
{
"ts": 1548762314784,
"dictionary": [
{
"freq": 250,
"shortcut": "dodane do testów",
"word": "słowo testowe",
"locale": "pl_PL"
}
]
}
3.12 GEOLOCATION
- Explanation:
Geolocalization coordinates of a device, information of current GSM cell and GSM signal strength.
- Required permissions:
Manifest.permission.ACCESS_FINE_LOCATION
Manifest.permission.ACCESS_COARSE_LOCATION
Since Android 10 accessing lcation when is not in foreground is posiible only after declaring Manifest.permission.ACCESS_BACKGROUND_LOCATION. Documentation strongly states that accessing background is forbidden for purpose of gathering analytic data. Applications requesting access to background location undergo excessive audit procedure. Because of that there GEOLOCATION can obtain current location only as active collector - when app is in foreground. Last known location can be obtained by passive collector.
- Optional permissions:
none
- Variable description:
acc - estimated accuracy of this location, in meters
spd - speed if it is available, in kilometers/hour over ground
ls - name of the provider that generated this fix
lt - location time
ltLoc - true if time is local
cid - gsm cell id, -1 if unknown, 0xffff max legal valu
lac - gsm location area code, -1 if unknown, 0xffff max legal value
signalData - signal strength json object
location - json object containing location data
coordinates - json array with latitude and longitude coordinates
type - always as Point
br - bearing, in degrees, bearing is the horizontal direction of travel of this device, and is not related to the device orientation
- Example:
{
"ts": 1564136345488,
"geolocation": {
"acc": 29.54,
"ls": "fused",
"lt": 1564136345338,
"location": {
"coordinates": [
52.2318224,
21.1063799
],
"type": "Point"
},
"cid": 46337572,
"br" : 200,
"lac": 58170,
"ltLoc": true
}
}
3.13 HEADSET_PLUG
- Explanation:
Collect all data about headset plugin's information.
- Required permissions:
none
- Optional permissions:
none
- Variable description:
start - plug in timestamp
end - plug out timestamp
microphone - is microphone
headphone - is headphone
name - name if exist
- Example:
{
"ts": 1548763985160,
"headsetPlug": {
"headsetPlug": [
{
"start": 1548763789550,
"end": 1548763912421,
"microphone": false,
"headphone": true
}
]
}
}
3.14 MEDIA_FILES
- Explanation:
Gather Media files information of device.
- Required permissions:
Manifest.permission.READ_EXTERNAL_STORAGE (on Android api level >= Jelly Bean 4.1)
- Optional permissions:
none
- Variable description:
image - json object with image media data
nonMedia - json object with non media data
audio - json object with audio media data
video - json object with video media data
totalBytes - size in bytes
totalFiles - number of files
newFiles - new files number
newBytes - size in bytes
deletedFiles - deleted files number
deletedBytes - deleted size in bytes
sinceTs - timestamp
- Example:
{
"ts": 1548764886837,
"mediaFiles": {
"image": {
"totalBytes": 33569637,
"totalFiles": 85
},
"nonMedia": {
"totalBytes": 67371316,
"totalFiles": 277
},
"audio": {
"totalBytes": 5576521,
"totalFiles": 3
},
"video": {},
"sinceTs": 1547018493079
}
}
3.15 MEMORY_USEAGE
- Explanation:
Collect used memory info.
- Required permissions:
none
- Optional permissions:
none
- Variable description:
total - total in kB
buffers - buffers in kB
cached - cached in kB
free - free in kB
- Example:
{
"ts": 1548765433296,
"memoryUse": {
"total": 2847404,
"buffers": 1291312,
"cached": 3560,
"free": 87684
}
}
3.16 MESSAGE - deprecated
- Explanation:
Collect all data history from sms and mms. Due to new Google policy changes we can't collect call informations. Read more here
- Required permissions:
Manifest.permission.READ_SMS
- Optional permissions:
none
- Variable description:
date - date
bodyLength - message length
incoming - incoming sms/mms
sent - sent sms/mms
inbox - inboxed sms/mms
outbox - outbox sms/mms
failed - failes send sms/mms
queued - waiting in queue sms/mms
- Example:
{
"smsData": {
"draft": [
{
"date": "",
"bodyLength": ""
}
],
"incoming": [
{
"date": "",
"bodyLength": ""
}
],
"sent": [
{
"date": "",
"bodyLength": ""
}
],
"inbox": [
{
"date": "",
"bodyLength": ""
}
],
"outbox": [
{
"date": "",
"bodyLength": ""
}
],
"failed": [
{
"date": "",
"bodyLength": ""
}
],
"queued": [
{
"date": "",
"bodyLength": ""
}
]
}
}
3.17 NETWORK_CONNECTION
- Explanation:
Collect about connection information: "wifi" or "mobile data" or "no connection".
- Required permissions:
Manifest.permission.ACCESS_NETWORK_STATE
- Optional permissions:
none
- Variable description:
type - connection type (no connection, mobile data, wifi)
ts - the timestamp when the event occurred
locTs - true if ts is local, false otherwise
- Example:
{
"ts": 1548766520028,
"networkConnection": {
"connection": [
{
"type": "no connection",
"ts": 1548766200083
},
{
"type": "mobile data",
"ts": 1548766402136
},
{
"type": "wifi",
"ts": 1548766402739
}
]
}
}
3.18 NETWORK_USAGE
- Explanation:
Collect all network usage data from all application on device. Works till Android Marshmallow 6.0.
- Required permissions:
none
- Optional permissions:
none
- Variable description:
totalTxBytes - number of bytes transmitted since device boot
mobileTxBytes - number of bytes transmitted across mobile networks since device boot
mobileRxBytes - number of bytes received across mobile networks since device boot
totalRxBytes - number of bytes received since device boot.
sinceTs - timestamp
locTs - true if sinceTs is local, false otherwise
mobileTxPackets - number of packets transmitted across mobile networks since device boot
mobileRxPackets - number of packets received across mobile networks since device boot
totalRxPackets - number of packets received since device boot
totalTxPackets - number of packets transmitted since device boot
apps - json array with apps network usage
launcher - got "good" intent to launch a front-door activity in a package
packageName - application package name
- Example:
{
"ts": 1548767131411,
"networkUsage": {
"totalTxBytes": 16731554,
"mobileRxBytes": 0,
"apps": [
{
"totalTxBytes": 433532,
"launcher": true,
"packageName": "spicymobile.sample2.mobience",
"totalRxBytes": 550934
}
],
"totalRxBytes": 92932021,
"sinceTs": 1548067012569,
"mobileTxPackets": 0,
"mobileRxPackets": 0,
"mobileTxBytes": 0,
"totalRxPackets": 111935,
"totalTxPackets": 82378
}
}
3.19 NFC_COLLECTOR
- Explanation:
NFC collector collects information of NFC funtion of that device, contains normal NFC NFED information.
- Required permissions:
Manifest.permission.NFC
- Optional permissions:
none
- Variable description:
NFC - json object with nfc data
NFED - json object with nfed data (Android Beam file transfer)
isSupported - true if device support nfc/nfed feature, false otherwise
isEnabled - tru if nfc/nfed is enable
- Example:
{
"ts": 1566982896999,
"nfcInfo": {
"NFED": {
"isSupported": false
},
"NFC": {
"isSupported": false
}
}
}
3.20 PACKAGE_CHANGE
- Explanation:
Collect all package change event (install new app, remove app, data clear, restart app).
- Required permissions:
none
- Optional permissions:
none
- Variable description:
versionName - version name of application
name - application name
uid - application uid
versionCode - version code of application
action - change action (added, removed, restarted, dataCleared, replaced)
replacing - true if replaced, false otherwise
dataRemoved - true if data removed
- Example:
{
"ts": 1548768769016,
"packageChanges": {
"versionName": "27.0.215462205",
"name": "com.google.android.talk",
"uid": 10076,
"versionCode": 25335509,
"action": "restarted"
}
}
{
"ts": 1567150590629,
"packageChanges": {
"uid": 11422,
"name": "pl.meonmobile.searchplaces",
"action": "removed",
"replacing": false,
"dataRemoved": true
}
}
3.21 PERMISSION_COLLECTOR
- Explanation:
SDKAppPermission gathers every week list of all the Android permissions that it have and list of enabled data collectors from MobienceSDK.
- Required permissions:
none
- Optional permissions:
none
- Variable description:
collectors - json object containing enabled collectors
permission - json array with granted permissions
sysPerm - json array with system level permissions
sigPerm - json array with signature level permissions
dangPerm - json array with dangerous level permissions
gS - true if permission granted, false otherwise
Important "collectors" section information
Collector number 3 (Browser) has name "browserPhrases" and if it exists, it means that all three browser collectors (phrases, history, bookmarks) are working.
- Example:
{
"ts": 1587626370619,
"SDKAppPermissions": {
"collectors": {
"3": "browserPhrases",
"22": "SDKAppPermissions"
},
"permissions": [
"android.permission.INTERNET",
"android.permission.ACCESS_COARSE_LOCATION",
"android.permission.ACCESS_FINE_LOCATION"
],
"sysPerm": [
{
"name": "android.permission.DELETE_PACKAGES",
"gS": false
}
],
"sigPerm": [
{
"name": "android.permission.GET_TOP_ACTIVITY_INFO",
"gS": false
},
{
"name": "android.permission.PACKAGE_USAGE_STATS",
"gS": false
},
{
"name": "accessibility",
"gS": false
},
{
"name": "ignoreBatteryOptimizations",
"gS": false
}
],
"dangPerm": [
{
"name": "android.permission.ACCESS_COARSE_LOCATION",
"gS": true
},
{
"name": "android.permission.ACCESS_FINE_LOCATION",
"gS": true
},
{
"name": "android.permission.READ_PHONE_STATE",
"gS": true
}
]
}
}
3.22 PHONE_INFO
- Explanation:
Collect informations of a device, such as: Identifiers of device model, system version, IMSI, IP, network operator of SIM card and mobile network, WiFi network data, etc.
- Required permissions:
none
- Optional permissions:
android.permission.READ_PHONE_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
- Variable description:
boottime - UNIX timestamp when last boot occurred (available sice sdk 1.4)
awaketime - milliseconds since boot, not counting time spent in deep sleep
df - A string that uniquely identifies this build.
sbr - The screen backlight brightness between 0 and 255
os - android system version
nt - name describe the type of the network, for example (WIFI, MOBILE, offline), requires optional permission ACCESS_NETWORK_STATE
ns - human-readable name describing the subtype of the network, requires optional permission ACCESS_NETWORK_STATE
bssid - basic service set identifier (BSSID) of the current access point, requires optional permission ACCESS_WIFI_STATE
nopc - numeric name (MCC+MNC) of current registered operator.
ip - current ip
vlsm - audio stream level for music playback
dm - The end-user-visible name for the end product.
imsi - unique subscriber ID, for example, the IMSI for a GSM phone, requires optional permission READ_PHONE_STATE
ssid - service set identifier (SSID) of the current 802.11 network, requires optional permission ACCESS_WIFI_STATE
nop - alphabetic name of current registered operator.
mac - MAC address, requires optional permission ACCESS_WIFI_STATE
dr - screen heightXwidth
uptime - milliseconds since boot, including time spent in sleep.
dv - manufacturer of the product/hardware.
sop - Service Provider Name (SPN).
lan - name for the locale's language that is appropriate for display to the user.
sopc - MCC+MNC (mobile country code + mobile network code) of the provider of the SIM. 5 or 6 decimal digits.
pl - device system (currently only support Android)
vlr - audio stream level for the phone ring
dc - device type (TB, CF)
ip - IP address
- Example:
{
"ts": 1548770227737,
"phoneInfo": {
"awaketime": 273412299,
"df": "HONOR/LLD-L21/HWLLD-H:8.0.0/HONORLLD-L21/135(C185):user/release-keys",
"sbr": 41,
"os": "8.0.0",
"nt": "WIFI",
"bssid": "7a:8a:20:21:c9:d0",
"nopc": "26002",
"ip": "10.0.0.73",
"vlsm": 0,
"dm": "LLD-L21",
"imsi": "260021722534787",
"ssid": "\"Spicy Mobile\"",
"nop": "T-Mobile.pl",
"mac": "A4:93:3F:5F:00:7E",
"dr": "2032x1080",
"uptime": 1751734597,
"boottime": 1573952930107,
"dv": "HUAWEI",
"sop": "T-Mobile.pl",
"lan": "polski",
"sopc": "26002",
"pl": "Android",
"vlr": 0,
"dc": "CF",
"ip" : "192.168.1.1"
}
}
3.23 PROFILE_MODE
- Explanation:
Collect time change profile mode.
- Required permissions:
none
- Optional permissions:
none
- Variable description:
profile - array containing json objects with profiles
mode - selected mode (normal, silent, vibrate)
ts - timestamp when event occured
locTs - true if timestamp is local, false otherwise
- Example:
{
"ts": 1550047296392,
"profileMode": {
"profile": [
{
"ts": 1550047296375,
"mode": "normal"
}
]
}
}
3.24 ROAMING
- Explanation:
Catch event roaming.
- Required permissions:
Manifest.permission.ACCESS_NETWORK_STATE
- Optional permissions:
none
- Variable description:
startRoaming - start roaming timestamp
stopRoaming - stop roaming timestamp
- Example:
{
"ts": 1566983257084,
"roamingUse": {
"startRoaming": 1566983257084,
"stopRoaming": 1566983457084
}
}
3.25 SCREEN_ORIENTED
- Explanation:
Collect data about device's orientation.
- Required permissions:
none
- Optional permissions:
none
- Variable description:
oriented - screen rotation (portrait, landscape, reverse portrait, reverse landscape,"")
timestamp - timestamp when event occured
- Example:
{
"ts": 1548844277703,
"screenOriented": {
"oriented": "portrait",
"timestamp": 1548844280936
}
}
3.26 SIGNAL_STRENGTH
- Explanation:
Collect phone signal info.
- Required permissions:
none
- Optional permissions:
none
- Variable description:
cdmaDbm - CDMA RSSI value in dBm
cdmaEcio - CDMA Ec/Io value in dB*10
gsmBitErrorRate - GSM bit error rate (0-7, 99) as defined in TS 27.007 8.5
evdoDbm - EVDO RSSI value in dBm
gsmSignalStrength - GSM Signal Strength, valid values are (0-31, 99) as defined in TS 27.007 8.5
isGsm - true if this is for GSM
evdoSnr - EVDO RSSI value in dBm
- Example:
{
"ts": 1548844575858,
"signalStrength": {
"cdmaDbm": 0,
"cdmaEcio": 0,
"gsmBitErrorRate": -710850948,
"evdoDbm": 32767,
"gsmSignalStrength": 0,
"isGsm": true,
"evdoSnr": 32767
}
}
3.27 WIFI_DATA_CONNECTION
- Explanation:
Gather list of visible WiFi networks, information of each wifi. To learn more about wifi network restrictions click here.
- Required permissions:
Manifest.permission.ACCESS_WIFI_STATE - allow gather information about user connected wifi network
- Optional permissions:
Android <= 8.1 (sdk level <= 27)
- Manifest.permission.ACCESS_FINE_LOCATION or Manifest.permission.ACCESS_COARSE_LOCATION - to get nearby wifi networks
- Manifest.permission.CHANGE_WIFI_STATE, Manifest.permission.ACCESS_FINE_LOCATION or Manifest.permission.ACCESS_COARSE_LOCATION - to start wifi networks scan
Android 9.0, 10 (sdk level 28, 29)
- Manifest.permission.ACCESS_FINE_LOCATION or Manifest.permission.ACCESS_COARSE_LOCATION, enabled location services - to get nearby wifi networks
-Manifest.permission.ACCESS_FINE_LOCATION or Manifest.permission.ACCESS_COARSE_LOCATION, enabled location services, Manifest.permission.CHANGE_WIFI_STATE - to start wifi networks scan
Applications targeting Android 10 (API level 29) SDK or higher, has the Manifest.permission.ACCESS_FINE_LOCATION.
- Variable description:
BSSID - basic service set identifier (BSSID) of the current access point.
SSID - service set identifier (SSID) of the current 802.11 network
signal_strength - wifi signal strength
status - 1 if connected, 0 otherwise
connect_hourperiod - connected time in milliseconds
location - json object containing location data
coordinates - json array with latitude and longitude coordinates
type - always as Point
- Example:
{
"ts": 1548846466858,
"wifiDataConnection": [
{
"BSSID": "3c:77:e6:55:fc:e8",
"signal_strength": -65,
"SSID": "HP-Print-E8-LaserJet M1217",
"status": 0
},
{
"BSSID": "7a:8a:20:21:c9:d0",
"signal_strength": -49,
"SSID": "Spicy Mobile",
"status": 1,
"connect_hourperiod": 1548846000082,
"location": {
"coordinates": [
52.2318224,
21.1063799
],
"type": "Point"
},
},
{
"BSSID": "cc:2d:e0:95:72:03",
"signal_strength": -76,
"SSID": "secured",
"status": 0
}
]
}
3.28 FACEBOOK_NETWORK_COLLECTOR
- Explanation:
Collect user facebook account data.
- Required permissions:
none
- Optional permissions:
none
- Variable description:
birthday - user day of birth
hometown - user hometown
name - user name
location - user location
id - user unique ID
email - user email
- Example:
{
"ts": 1548848391393,
"facebookInfo": {
"birthday": "01/01/1989",
"hometown": "Warsaw, Poland",
"name": "Jan Kowalski",
"location": "Warsaw, Poland",
"id": "1477748925836755",
"email": "it@spicymobile.pl"
}
}
3.29 ROOT_COLLECTOR
- Explanation:
Collects information if device is rooted.
- Required permissions:
none
- Optional permissions:
none
- Variable description:
isRooted - true if rooted, false otherwise
- Example:
{
"ts": 1549966944836,
"rootEnabled": {
"isRooted": false
}
}
3.30 MOVEMENT_COLLECTOR
- Explanation:
Collects information about user activity transitions (e.g., WALKING).
- Required permissions:
com.google.android.gms.permission.ACTIVITY_RECOGNITION
- Optional permissions:
none
- Variable description:
eventName - occured event name (currently supported STILL, WALKING, ON_BICYCLE, ON_FOOT, IN_VEHICLE, RUNNING, UNKNOWN)
possible events description:
IN_VEHICLE: The device is in a vehicle, such as a car.
ON_BICYCLE: The device is on a bicycle.
ON_FOOT: The device is on a user who is walking or running.
RUNNING: The device is on a user who is running. This is a sub-activity of ON_FOOT.
STILL: The device is still (not moving).
TILTING: The device angle relative to gravity changed significantly. This often occurs when a device is picked up from a desk or a user who is sitting stands up.
UNKNOWN: Unable to detect the current activity.
WALKING: The device is on a user who is walking. This is a sub-activity of ON_FOOT.
type - detected event state (ENTER,EXIT,UNKNOWN)
timestamp - timestamp when event occured
- Example:
{
"ts": 1567595978339,
"movement": {
"transitions": [
{
"eventName": "RUNNING",
"location": {
"coordinates": [
37.4219983,
-122.084
]
},
"type": "ENTER",
"timestamp": 1567595978368
}
]
}
}
3.31 USB_COLLECTOR
- Explanation:
USB data collector collects information about connected USB devices.
- Required permissions:
none
- Optional permissions:
none
- Variable description:
status - attached or detached
manufacturer - the manufacturer name of the device. Only available for android version >= Lollipop 21.
productName - the product name of the device. Only available for android version >= Lollipop 21.
serialNum - the serial number of the device. Only available for android version >= Lollipop 21.
maxPower - the configuration's max power consumption, in milliamps. Only available for android version >= Lollipop 21.
version - the version number of the device. Only available for android version >= Marshmallow 23.
name - he name of the device. In the standard implementation, this is the path of the device file for the device in the usbfs file system.
timestamp - event timestamp.
- Example:
{
"ts": 1581501024406,
"usbConnectedDevice": {
"serialNum": "1226000000000D1F",
"status": "attached",
"productName": "STORE N GO",
"version": "2.0",
"name": "/dev/bus/usb/001/004",
"timestamp": 1581501029080,
"manufacturer": "Verbatim",
"maxPower":100
}
}
3.32 STANDBY_BUCKET_COLLECTOR
- Explanation:
Standby bucket data collector collector collects information about standby bucket the application using SDK is placed in. Android system selects the standby bucket based on how often the user interacts with the application. The amount of background jobs and alarms, that the application can run is the assigned based on the standby bucket the application is categorized into.
- Required permissions:
none
- Optional permissions:
none
- Variable description:
standbyBucketValue - current value of standby bucket while the data collector runs
possible values of standby bucket:
Exempted: App is exempted from battery optimisation. There are no limits on the resources allocated for the app
Active: App is currently being used or was very recently used.
Working set: App is in regular use.
Frequent: App is often used, but not every day.
Rare: App is not frequently used.
Restricted: App consumes a great deal of system resources, or may exhibit undesirable behavior
- process - process for which the datacollector is invoked. Main process of the app and Mobigate SDK process may be in different standby buckets.
usageEvents - a list standby bucket changes since app was installed
eventTs - timestamp of bucket change
eventBucket - bucket that the app was categorized into at a given timestamp - Example:
{
"ts": 1557825443149,
"standbyBucket": {
"standbyBucketValue": "STANDBY_BUCKET_ACTIVE",
"process": "SDK",
"usageEvents":[
{
"eventTs": 876876876876876,
"eventBucket": "STANDBY_BUCKET_ACTIVE"
},
{
"eventTs": 876876876876876,
"eventBucket": "STANDBY_BUCKET_ACTIVE"
},
]
}
}
4.0 Default Collection interval
- APPS_LIST - 24h
- APPS_USAGE - 24h
- BATTERY - passive - level (every 1h), active - charge events broadcast
- BROWSER - 24h
- CALENDAR_EVENTS - 24h
- CPU_PROCESS - 1h
- DICTIONARY - 7d
- GEOLOCATION - passive - 4h, active - interval 70s, accuracy 5
- HEADSET_PLUG - active - broadcast
- MEDIA_FILES - 24h
- MEMORY_USEAGE - 2h
- NETWORK_CONNECTION - active - broadcast
- NETWORK_USEAGE - 1h
- PACKAGE_CHANGE - active - broadcast
- PHONE_INFO - 1h
- ROAMING - active - broadcast
- SCREEN_ORIENTED - 2h
- SIGNAL_STRENGTH - active - broadcast
- PROFILE_MODE - active - broadcast
- WIFI_DATA_CONNECTION - active - broadcast
- PERMISSION_COLLECTOR - 7d
- NFC_COLLECTOR - 1h
- BLUETOOTH_COLLECTOR - 1h
- BLUETOOTH_DEVICES_COLLECTOR - broadcast (works while app is in background)
- MOVEMENT_COLLECTOR - broadcast (works while app is in background)
- FACEBOOK_NETWORK_COLLECTOR - 24h
- ROOT_COLLECTOR - 1m
- USB_COLLECTOR - broadcast (works while app is in background)
- STANDBY_BUCKET_COLLECTOR - 24h
5. Collector json object names
"appsList","appsUsage2","appsUsage","batteryInfo","bluetoothInfo","bluetoothLE","bluetoothConnectedDevice","browserHistory","browserBookmarks",
"browserPhrases","calendarEvent","callLogData","cpuProcess","dictionary","geolocation","headsetPlug","mediaFiles","memoryUse","smsData","networkConnection",
"networkUsage","nfcInfo","packageChanges","SDKAppPermissions","phoneInfo","profileMode","roamingUse","screenOriented","signalStrength","wifiDataConnection",
"facebookInfo","rootEnabled","movement","usbConnectedDevice", "standbyBucket"
6. Description of permissions
A full description of all permits on the android system can be found here