Smart Protection

Various customization degrees are possible when integrating Malwarelytics into an app. For full control over its behavior, raw APIs — observers and method calls — can be used. An entirely different approach is a hassle-free SDK integration using the built-in Smart Protection system.

Smart Protection is a set of behavior patterns that are enabled by default. These patterns include a periodic evaluation of apps installed on the device, suggestion updates, initial scans, and an automatic evaluation of app changes.

There are two basic modes of operation:

1. Silent mode — default option. It does not show any UI but simply keeps the data up to date with the remote console.

2. Non-silent mode — facilitates automatic mitigation of detected threats. The available options are:

   • Display an app screen with a list of dangerous apps.
   • Display a notification about a dangerous app.

Configuration

Smart Protection can be configured to some extent using the SmartProtectionConfig settings in the AntivirusConfig.Builder.

val smartProtectionConfig = AntivirusConfig.SmartProtectionConfig.Builder()
                        .smartProtectionEnabled(true)
                        .silentModeEnabled(true)
                        .smartProtectionIntervalHours(72)
                        .performInitialFirstUpdate(true)
                        .build()

val antivirusConfig = AntivirusConfig.Builder()
    // other Anti-Malware feature configuration
    .smartProtectionConfig(smartProtectionConfig)
    .build()

Information about Updates and Troubleshooting

Smart Protection performs automatic updates that are hidden from the integrating app. In some cases, the app wants to react to freshly updated data, get some update information, or the app developers need to investigate a problem.

For this reason, the SDK offers:

1. Update observer.
2. Info data about the last successful and unsuccessful updates.

Registering an Update Observer

The application can register UpdateObserver to get notified about performed updates. The observer callback provides info data about the finished update. The observer configuration:

val updateObserver = object : UpdateObserver {
   override fun onSuggestionUpdated(observedUpdateInfo: ObservedUpdateInfo) {
       // handle observedUpdateInfo
   }
}

The observer can be registered in UpdateManager which is accessible via the Antivirus class.

val updateManager = AppProtection.getInstance().getAntivirus().getUpdateManager()
updateManager.registerUpdateObserver(updateObserver)

When it is no longer needed, the observer can be unregistered again.

updateManager.unregisterUpdateObserver(updateObserver)

The ObservedUpdateInfo data class has the following properties:

The performed updates can have one of these results:

The performed updates can be of these types:

Information about Past Updates

The SDK stores some information about past updates. This information can be obtained by calling:

val antivirus = AppProtection.getInstance().getAntivirus
val updateInfo = antivirus.getUpdateManager.getLastUpdateInfo()

The UpdateInfo data class has the following properties:

Updates with the result UpdateResult.PARTIAL_SUCCESS are counted as failed updates here.

The UpdateInfoSuccess data class contains the following properties:

The UpdateInfoFailure data class contains the following properties: