Detection Layers

The freeMalwareDetection SDK utilizes a Defense-in-Depth architecture. Because no single scanning methodology can identify every type of threat without generating excessive false positives, the device environment is evaluated across multiple distinct analytical layers. This section documents the specific mechanisms the engine uses to evaluate installed applications.

---

Multi-Layered Security Model

The detection pipeline operates through two consecutive stages, scaling from fast, deterministic checks to complex, behavioral intelligence:

1

Static Identification

Fast matching of installed applications against your defined lists of forbidden package names and SHA-256 hashes.

2

Behavioral & Contextual Analysis

Deep inspection of an app's characteristics — such as whether it was side-loaded from an unofficial source and if it requests dangerous permissions — to catch zero-day malware.

Looking for an additional layer? Premium Malware Detection extends this pipeline with real-time cloud verification against a continuously updated global threat database.

---

Exploring the Layers

The following sections detail the exact evaluation logic, the required configuration, and the resulting incident flags. Review each layer to understand how to construct a comprehensive threat model for your application:

App Blocklists

Static identification mechanisms using package names and cryptographic hashes.

Behavioral Heuristics

Contextual analysis, installation source verification, and heuristic evaluation logic.