Smart Protection

Various customization degrees are possible when integrating Malwarelytics into an app. For full control over its behavior, raw APIs — observers and method calls — can be used. An entirely different approach is a hassle-free SDK integration using the built-in Smart Protection system.

Smart Protection is a set of behavior patterns that are enabled by default. These patterns include a periodic evaluation of apps installed on the device, suggestion updates, initial scans, and an automatic evaluation of app changes.

There are two basic modes of operation:

  1. Silent mode — default option. It does not show any UI but simply keeps the data up to date with the remote console.

  2. Non-silent mode — facilitates automatic mitigation of detected threats. The available options are:

    • Display an app screen with a list of dangerous apps.
    • Display a notification about a dangerous app.

Configuration

Smart Protection can be configured to some extent using the SmartProtectionConfig settings in the AntivirusConfig.Builder.

val smartProtectionConfig = AntivirusConfig.SmartProtectionConfig.Builder()
                        .smartProtectionEnabled(true)
                        .silentModeEnabled(true)
                        .smartProtectionIntervalHours(72)
                        .performInitialFirstUpdate(true)
                        .build()

val antivirusConfig = AntivirusConfig.Builder()
    // other Anti-Malware feature configuration
    .smartProtectionConfig(smartProtectionConfig)
    .build()

Learn about UI customization of Smart Protection elements in this article.

Information about Updates and Troubleshooting

Smart Protection performs automatic updates that are hidden from the integrating app. In some cases, the app wants to react to freshly updated data, get some update information, or the app developers need to investigate a problem.

For this reason, the SDK offers:

  1. Update observer.
  2. Info data about the last successful and unsuccessful updates.

Registering an Update Observer

The application can register UpdateObserver to get notified about performed updates. The observer callback provides info data about the finished update. The observer configuration:

val updateObserver = object : UpdateObserver {
   override fun onSuggestionUpdated(observedUpdateInfo: ObservedUpdateInfo) {
       // handle observedUpdateInfo
   }
}

The observer can be registered in UpdateManager which is accessible via the Antivirus class.

val updateManager = AppProtection.getInstance().getAntivirus().getUpdateManager()
updateManager.registerUpdateObserver(updateObserver)

When it is no longer needed, the observer can be unregistered again.

updateManager.unregisterUpdateObserver(updateObserver)

The ObservedUpdateInfo data class has the following properties:

Property Description
updateResult: UpdateResult Update result. One of SUCCESS, PARTIAL_SUCCESS, or FAILURE.
updateType: UpdateType Type of update. Either FULL or PARTIAL
checkedApps: List<String> List of apps that were checked in the update. The apps are identified by their application IDs (package names).
updatedApps: List<String> List of apps that were updated in the update. The apps are identified by their application IDs (package names).
failureReason: String? String representation of an error that occurred during processing of the update.

The performed updates can have one of these results:

UpdateResult Description
SUCCESS Successful update. All apps (that were checked in the update) were successfully updated without any error.
PARTIAL_SUCCESS Partially successful update. Some apps were successfully updated but not all of them. The update of some apps failed for some reason.
FAILURE Failed update. The update failed completely for some reason.

The performed updates can be of these types:

UpdateType Description
FULL Updates data for all apps on the device.
PARTIAL Updates data for apps that were observed as changed - newly installed or updated.

Information about Past Updates

The SDK stores some information about past updates. This information can be obtained by calling:

val antivirus = AppProtection.getInstance().getAntivirus
val updateInfo = antivirus.getUpdateManager.getLastUpdateInfo()

The UpdateInfo data class has the following properties:

Property Description
successfulUpdates: Map<UpdateType, UpdateInfoSuccess> Map of success info data for each UpdateType.
failedUpdates: Map<UpdateType, UpdateInfoFailure> Map of failure info data for each UpdateType.

Updates with the result UpdateResult.PARTIAL_SUCCESS are counted as failed updates here.

The UpdateInfoSuccess data class contains the following properties:

Property Description
lastSuccessTimestamp: Long? Unix timestamp of the last successful update, or null if there has been no successful update yet.
lastSuccessCheckCount: Int Number of checked apps in the last successful update, or 0 if there has been no successful update yet.
lastSuccessUpdatedCount: Int Number of updated apps in the last successful update, or 0 if there has been no successful update yet.

The UpdateInfoFailure data class contains the following properties:

Property Description
lastFailureTimestamp: Long? Unix timestamp of the last failed update, or null if there has been no failed update yet.
lastFailureReason: String? String representation of a failure reason of the last failed update, or null if there has been no failed update yet.
Last updated on Feb 08, 2024 (15:49) View product
Search

develop

Malwarelytics for Android