Research spin-out · SMU
See what the device
See what the device
won't show you.
Ansteroid builds observation instruments for the mobile edge — precise, deterministic tooling that reveals what an app is really doing, and what a user is really choosing. Two instruments, one discipline: watch the layers others can't reach.
The problem we solve
The behaviour that matters is the behaviour you can't see.
On a modern phone, the decisive moment happens out of sight — deep inside a running app, or fleeting on a screen you don't control. Each Ansteroid instrument closes one of those blind spots.
FA³ · inside the app
Threats don't sit on the surface anymore.
Modern Android threats load code at runtime, execute inside native libraries, and cross into the system through JNI — where permission audits, static scanners and emulator-based tools cannot follow. The behaviour that matters happens while the app is running, and most tooling never sees it.
Outsight · beside the app
The moment passes before you can respond.
A customer choosing, a victim being coerced, an account being taken over — it happens inside an app you don't own, and it's gone in seconds. Adding an SDK means changing the app; interrupting the user breaks the flow; server logs arrive too late. The signal is right there on the device, and nothing safe is listening for it.
Two instruments
One brand, two vantage points on the same device.
FA³ looks inside — down through every runtime layer of an Android app. Outsight looks beside — reading the CPU's side channel to know what a user chose, without ever touching the app.
Product · Inside
Explore Outsight →
FA³ Fine-Grained Android Application Analysis
Deterministic, on-device runtime tracing across Java · ART · JNI · Native — no emulator, no root, no app modification.
Explore FA³ →
Product · Beside
Outsight External Side-Channel Action Detection
Real-time, consent-based insight into in-app user actions from outside the app — reported as a plain-language, timestamped label.
observed
insight
One discipline
The same discipline under both products.
FA³ and Outsight look at different things — but they're built on the same four commitments. It's what makes either one credible in front of an agency or a bank.
Principle 01
Research origin
Built inside SMU's security research centre and validated in peer review — the science comes before the pitch.
Principle 02
Deterministic by design
The same app, run again, produces the same trace. Evidence you can reproduce, not a score you have to trust.
Principle 03
Observe without altering
No repackaging, no instrumentation of the target, no root. The app behaves exactly as it would in a user's hand.
Principle 04
On the real device
Analysis runs on physical handsets, so anti-emulator evasion has nothing to hide behind.
Recognition
Published at USENIX Security 2024 · ACM HotMobile 2023. Google confirmed the underlying sandbox-integrity finding at moderate severity through responsible disclosure (2024).
Research origin · credibility
Born in a university lab. Trusted at agency scale.
Origin
SMU research — Centre on Security, Mobile Applications and Cryptography
Peer-reviewed
USENIX Security '24 · ACM HotMobile '23
Adoption
Adopted by a leading Singapore security agency
Track record
Agency relationships since 2021
Research & publications
The engineering is public where it can be.
Ansteroid's methods are grounded in peer-reviewed research from SMU. The public record below is a starting point — deeper technical material is shared under NDA.
Product · FA³ · Inside the app
What is this app actually
What is this app actually
doing on the device?
FA³ answers that question deterministically — by tracing a real app on a real handset, all the way down. No emulator. No root. No modification to the app under test. Every layer, every call, reconstructed.
Why it matters
The apps people trust are leaking.
Independent analysis of mobile financial apps keeps surfacing the same gaps — the kind only device-level tracing reveals.
81%
of financial apps leak sensitive data
77%
use at least one vulnerable cipher
18.85%
ship leaky cloud configurations
3.5M+
apps on the Play Store to vet
The depth problem
Static analysis stops at the waterline. FA³ doesn't.
An Android app runs across four layers. Most tools see one or two — the visible tip. FA³ instruments every layer, from managed Java down to native code, on the live device.
JavaManaged application code & framework APIstraced
ARTAndroid Runtime — bytecode execution, JIT/AOTtraced
▼ static analysis stops here
JNIJava ↔ native bridge — the usual blind spottraced
NativeC/C++ & syscalls, monitored in ART + kerneltraced
The set
Five properties, always together.
None of these is remarkable alone. Held as a set, on an unrooted retail handset, they're what makes FA³ different.
01On-DeviceRuns on a real handset, not an emulator or a farm.
02Non-InvasiveThe app under test is never modified, repackaged, or rooted.
03ART-AwareUnderstands the Android Runtime — not blind to bytecode.
04Multi-LayerJava, ART, JNI and Native — one continuous trace.
05Fine-GrainedCall-level detail, deterministically reconstructed.
// FA³ is deterministic — it is not an AI/ML classifier.
How it works
Four steps, one deterministic trace.
STEP 01
Select
Choose the target app and the handset to run it on.
STEP 02
Configure
Set the layers and depth of tracing required.
STEP 03
Execute & Trace
Run the app live; capture across every layer.
STEP 04
Reconstruct
Rebuild a complete, readable picture of behaviour.
Proof
Deployed where the stakes are real.
Origin
SMU research spin-out
Peer-reviewed
ACM HotMobile '23
Adoption
Live with a leading Singapore security agency
Since
Agency relationships since 2021
See it for yourself
See FA³ trace a live app.
Bring an app you're curious about. We'll run it on a real handset and show you what it does underneath.
Product · Outsight · Beside the app
Know what your customer chose —
Know what your customer chose —
before they're done choosing.
Outsight reads the device's own CPU side channel to detect what a user is doing inside another app — in real time, with no app modification and no root. It's the one-way mirror: you see the choice, the app never changes.
The one-way mirror
Observe the action. Never touch the app.
On one side, an ordinary app running on an ordinary unrooted phone. On the other, Outsight — turning micro-patterns in CPU behaviour into a clear, timestamped account of what just happened.
Observed side · the app
Insight side · Outsight
00:00.4Screen → Add Card
00:01.9Choice → Stored value
00:03.2Field → Amount entered
00:04.6Action → Confirm
The arrangement
Insight on one side, protection on the other.
Think of a one-way mirror. One party can see clearly; the other is shielded, and both know the arrangement and have agreed to it. That is how Outsight works. It reveals the action a user has taken so a business can respond in the moment — while the user's data, credentials and content stay on their side of the glass. This is consent-based insight, established and disclosed up front. It is not surveillance, and it is not covert.
How it runs
Observed from the outside.
Outsight runs in the background on Android and detects the actions a user takes inside another app. There is no change to the target app: no SDK, no code modification, no root. Each detected action is reported as a timestamped, plain-language label, and fires a phone notification immediately — so nothing has to stay open for the signal to arrive.
Why it matters
The decisive moment is over in seconds.
Fraud, coercion and account takeover don't announce themselves in a report — they happen live, inside an app, and are gone. Value comes from seeing the action while it's still unfolding.
The stakes
The damage is instant
By the time a server log is reviewed, the money has already moved. The events that matter last seconds.
The gap
A warning after the act is too late
Post-hoc alerts arrive once the action is done. The signal has to exist during the action to change the outcome.
The opening
A safe signal already exists
The device sees the action. Read consensually from outside, it becomes a chance to protect the user in the moment.
Two-level depth
Not just which screen — which choice within it.
Level 1 · Screen
Which screen the user is on
Detects context — e.g. the "Add Card" flow has begun.
Level 2 · Selection
Which option they picked within it
Distinguishes stored value from Credit/Debit from a bank transfer — the choice, not just the page.
How it works
Four steps, from signal to label.
STEP 01
Observe
Read the external CPU side channel — nothing inside the app.
STEP 02
Detect
Recognise the timing pattern of a specific action.
STEP 03
Label
Emit a plain-language, timestamped description.
STEP 04
Feed
Stream labels to the consuming system in real time.
How it can be applied
One signal, many jobs to be done.
The same consent-based, real-time action signal supports very different outcomes — from serving a customer better to stopping harm before it lands.
Analytics & next-best-action
Real intent, in the moment
With consent, see which services customers actually use and what they choose — a live signal for relevant offers instead of guesswork.
Scam & coercion detection
Catch the dangerous sequence
Flags high-risk in-app patterns — a new payee, a limit increase and a large transfer in quick succession — as they unfold, early enough to interrupt rather than reimburse. Runs on the user's own protected device, with consent.
App & malware fingerprinting
Behaviour, not the label
Builds a behavioural fingerprint of how a legitimate app version runs, then flags copies that deviate — catching repackaged and tampered builds a static scan would pass.
Account-takeover signals
Is the right person driving?
Notices when in-session navigation stops looking like the account owner, giving a signal to step up authentication — a consent-based control layered on the user's own sessions.
Compliance & audit trail
Evidence the steps happened
Captures each required action — disclosures, acknowledgements, KYC — timestamped and in order, turning "we believe the screens were shown" into an exportable, defensible record.
Assisted protection
A tripwire, not a watchtower
With the user's consent, watches only the few high-risk actions that cause harm and quietly alerts a trusted caregiver — protection for at-risk users, not monitoring of everything they do.
Demonstrated live
Shown working on a live, unmodified consumer app, on a real, unrooted device — detecting the in-app choice with no changes to the app and no root access.
Let's talk
See if there's a fit.
Outsight is research from SMU and Ansteroid. If it maps to something you're building, we'd like to talk.
Research & publications
The record, where it's public.
Ansteroid grew out of peer-reviewed work at SMU. This page collects the public-facing research; classified and commercial detail is shared separately under NDA.
USENIX Security '24
Yan Lin, Joshua Wong, Xiang Li, Haoyu Ma, Debin Gao · 33rd USENIX Security Symposium · research behind Outsight
ACM HotMobile '23
Yan Lin, Joshua Wong, Debin Gao · HotMobile '23, pp. 74–80 · foundational FA³ research
About Ansteroid
A university lab that ships.
Ansteroid is a research spin-out from SMU's Centre on Security, Mobile Applications and Cryptography — turning deep mobile-security research into instruments that agencies and enterprises can actually deploy.
Who we are
Research first, engineered for the field.
The Centre on Security, Mobile Applications and Cryptography (SMC) at Singapore Management University studies how mobile software really behaves — below the interface, below the runtime. FA³ and Outsight are that research made operational.
We work at the layer most tools skip: the live device. That's a deliberate choice, and it's why our instruments hold up in front of the people who rely on them.
Parent brandAnsteroid
InstitutionSingapore Management University
Research centreCentre on Security, Mobile Applications and Cryptography
ProductsFA³ · Outsight
SinceAgency relationships since 2021
The team
The people behind the instruments.
Led by our Principal Investigator, with research engineers building on the device and commercialisation taking it to market.
GD
Prof. Gao Debin
Principal Investigator · Director, SMU SMC
DD
Devroop Dutta
Commercialisation
LX
Li Xiang
Research Engineer
HZ
Hu Zixuan
Research Engineer
LS
Lokhande Santosh Hari
Research Engineer
DW
Dai Wei
Research Engineer
Contact
Start a conversation.
For briefings, evaluations, or research enquiries about FA³ and Outsight, reach the team directly. We respond to qualified agency and enterprise enquiries.
Address
Centre on Security, Mobile Applications and Cryptography
Singapore Management University,
10 Canning Rise, Level B2,
Singapore 179873.
10 Canning Rise, Level B2,
Singapore 179873.
Write to us
Email the team directly. To help us route your enquiry, it helps to include:
- Your organisation and role
- Which instrument — FA³, Outsight, or research collaboration
- What you are evaluating, and any timeline
Enquiries go straight to the research team — no ticketing system in between.