The problem WIRE WHISP solves

Problem Statement : LIGHTWEIGHT MOBILE NETWORK TRAFFIC ANALYZER

Problems Solved:

1. Information Asymmetry: Bridges the gap between what an app says it does and what it actually does on the wire.
2. Blind Trust Elimination: Moves the security model from "Trust Me" (app side) to "Show Me" (user side).
3. Hidden Tracker Exposure: Identifies and flags connections to known data brokers and advertising networks that are bundled into app SDKs.
4. Data Leakage Detection: Detects when sensitive information (like Auth tokens or PII) is being sent to unauthorized or high-risk geographic destinations.

The Solution (Wire Whisp)

1. Dual-Mode Interception: A 4-layer architecture built on Android’s VPN service to intercept traffic at the IP layer.
2. Passive Mode (Metadata Analysis): Monitors the "envelope" (IP, Port, Protocol, Size) to reconstruct behavior patterns without breaking encryption or compromising device security.
3. Active Mode (Deep Inspection): Uses an internal MITM Proxy (LittleProxy/Bouncy Castle) to temporarily decrypt authorized traffic, allowing users to see the actual JSON payloads and tracking pixels.
4. Real-Time Visualization: Uses MPAndroidChart and Jetpack Compose to transform raw network "flows" into a readable "heartbeat" dashboard.

Challenges we ran into

1. Performance & Latency (The "Zero-Lag" Challenge)

The Issue: Intercepting every single packet at Layer 3 using the VpnService API can significantly slow down the device's internet speed and drain the battery.

The Fix: We implemented "Kotlin Coroutines" to process thousands of packets per second asynchronously, ensuring that the background analysis never blocks the user’s UI or slows down their browsing experience.

2. Breaking the "Cloak" of Encryption

The Issue: Modern security standards (like Certificate Pinning and HSTS) are designed to prevent exactly what we are doing—intercepting HTTPS traffic.

The Fix: We developed a dual-mode system. Passive Mode analyzes only metadata (IP/Port/Size) so we don't need to break encryption to find suspicious patterns. For Active Mode, we utilized the Bouncy Castle library to generate dynamic, per-domain SSL certificates that allow authorized decryption when the user provides explicit permission.

3. Turning Raw Data into Human-Readable Info

The Issue: Raw IP addresses (like 142.250.190.46) are meaningless to an everyday user.

The Fix:We integrated "MiniDNS" to intercept and parse DNS queries in real-time. This allows us to map obscure IP addresses back to human-readable domain names like facebook.com or google-analytics.com.