Android Antivirus - Smart Protection

An app can integrate Malwarelytics for Android in various degrees of customization. On one extreme it can use its raw APIs - observers and method calls - and implement all the app behaviors. On the other extreme, it can integrate the SDK “hassle-free” and use the built-in Smart Protection.

Smart Protection is a set of automatic behaviors, that are enabled by default. They involve timed evaluations of the installed apps, suggestion updates, initial scans , and automatic evaluation of app changes.

There are two basic modes of operation:

1. Silent mode - Turned on by default. Does not show any UI. It simply keeps the data up-to-date with the remote console.

2. Non-silent mode - Involves automatic mitigations of detected threats.

Available automatic threat mitigations:

• Displaying app screen with a list of dangerous apps.
• Displaying notification about a dangerous app.

Configuring Smart Protection

Smart Protection can be configured in the initial cordova SDK initialization:

await window.plugins.malwarelytics.initialize({
    // Configuration for the Android platform
    androidConfig: {
        antivirus: { // Configuration of the antivirus component
            enableSilentMode: false, // Silent mode enabled = no UI
            onlineCheckIntervalHours: 48, // check for update every 48 hours
            updateOnInitialize: true // the virus database will be updated on the startup
        }
    }
}

Triggering Smart Protection

Smart protection feature can be triggered manually by calling:

await window.plugins.malwarelytics.android.antivirus.triggerSmartProtection();

Manual Threat Fetching

List of threats can be fetched manually via:

// obtain list of threats
const list = await window.plugins.malwarelytics.android.antivirus.getThreatList();
// filter and print out apps that are higli dangerous or malware
list.items.filter(i => i.threatIndex == "MALWARE" || i.threatIndex == "HIGHLY_DANGEROUS").forEach( async apk => {
    let apkInfo = await window.plugins.malwarelytics.android.antivirus.getApkInfo(apk.packageName);
    console.log(apkInfo);
});

Threat mitigation UI of the smart protection can be customized in the malwarelytics.xml.