RASP vs. Malware Detection

The Talsec SDK evaluates installation sources for two independent security products: RASP and Malware Detection. They operate separately and require distinct configurations.

---

How Each Product Evaluates Installation Sources

The following breakdown highlights how each product utilizes installation telemetry.

RASP

The RASP module is strictly focused on self-protection. When initialized, the SDK checks the installer of your own protected application and compares this value against your trusted sources configuration:

• If it matches: The app runs normally.

• If it doesn't match: RASP triggers the unofficialStore callback.

Malware Detection

Unlike RASP, Malware Detection looks outward. It scans the installation sources of every other application residing on the user's device. Each discovered app is evaluated individually against your trusted sources configuration. Any app originating from an unknown or untrusted source is flagged in the threat report.

Summary of Differences

	RASP	Malware Detection
Purpose	Verifies your protected app was delivered through an approved channel.	Excludes apps from trusted sources on the device from malware scanning.
Scope	Evaluates the installation source of your protected app.	Evaluates the installation sources of all other apps on the device.
Platform Supported	Android & iOS	Android Only
Triggered Callback	onUntrustedInstallationSourceDetected (Android native) unofficialStore (iOS & cross-platform)	onMalwareDetected (with reason installSource)