For the complete documentation index, see llms.txt. This page is also available as Markdown.
Detection Layers
The freeMalwareDetection SDK utilizes a Defense-in-Depth architecture. Because no single scanning methodology can identify every type of threat without generating excessive false positives, the device environment is evaluated across multiple distinct analytical layers. This section documents the specific mechanisms the engine uses to evaluate installed applications.
Multi-Layered Security Model
The detection pipeline operates through two consecutive stages, scaling from fast, deterministic checks to complex, behavioral intelligence:
1
Static Identification
Fast matching of installed applications against your defined lists of forbidden package names and SHA-256 hashes.
2
Behavioral & Contextual Analysis
Deep inspection of an app's characteristics — such as whether it was side-loaded from an unofficial source and if it requests dangerous permissions — to catch zero-day malware.
Looking for an additional layer?Premium Malware Detection extends this pipeline with real-time cloud verification against a continuously updated global threat database.
Exploring the Layers
The following sections detail the exact evaluation logic, the required configuration, and the resulting incident flags. Review each layer to understand how to construct a comprehensive threat model for your application:
App Blocklists
Static identification mechanisms using package names and cryptographic hashes.
Behavioral Heuristics
Contextual analysis, installation source verification, and heuristic evaluation logic.
