L1-L11 全端侧判定，L12 仅确认，断网可用。L1-L11 on-device, L12 confirm only, works offline.
白名单前置 + 应用商店来源抵扣40分 + 系统应用跳过。Whitelist-first, store -40 credit, system-app skip.
≥135分报毒，行为加权可解释。≥135 flags threat, weighted & auditable.
监控 DCIM 批量写，行为熔断，未知变种也拦。Watches DCIM bulk writes, behavior fuse, stops variants.
引擎与 UI 解耦，可编译为 AAR 常驻系统。Engine decoupled from UI, compilable to AAR.
单人单手机维护，厂商级引擎能力。Solo dev on one phone, vendor-grade engine.
误报压制：白名单 / 系统应用 / 学习黑 / 学习白 / 特征库。FP suppression: whitelist, system apps, learned black/white, sig lib.
特征与行为：正则 / 高危关键词 / 无障碍滥用 / 本地行为加权。Signature & behavior: regex, risky keywords, a11y abuse, local scoring.
未知闭环：启发式打分 + 云端哈希确认，哈希驱动不搜名。Unknown closure: heuristic + cloud hash confirm, hash-driven.
| 版本Version | 1.2.5 · build 125 · 2026-10-07 |
| 引擎Engine | 昆明引擎 12层端侧判定Kunming Engine 12-layer |
| 报毒阈值Threshold | ≥ 135 分；应用商店来源pts; store source -40 抵扣credit |
| 系统OS | Android 8.0 – 15 |
| 架构CPU | ARM64 / ARMv7 |
| 本地库Local DB | ≤ 5 万条 · 云端 MalwareBazaar 回流MalwareBazaar sync |
| 断网Offline | L1-L11 全端侧，L12 仅确认on-device, L12 confirm |
| 安装包Package | base.apk · SHA-256 见 version.jsonSHA-256 in version.json |
能。前11层全端侧，云端仅做确认，断网照常报毒、照常熔断。Yes. 11 layers on-device, cloud only confirms. Verdicts work offline.
白名单前置 + 应用商店抵扣40分 + 系统应用跳过，本地验证 0 误报。Whitelist-first + store -40 + system skip, 0 FP verified locally.
能。引擎与 UI 解耦，可编译为 AAR 或系统服务常驻。Yes. Engine decoupled, compiles to AAR or resident system service.
游龙公开引擎该样本 0 检出；昆明引擎端侧可识别该类伪装，0 误报。Youlong: 0 detection on that sample. Kunming detects it on-device, 0 FP.