> For the complete documentation index, see [llms.txt](https://docs.talsec.app/freerasp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.talsec.app/freerasp/freemalwaredetection/detection-layers/behavioral-heuristics.md). # Behavioral Heuristics The **Behavioral Heuristics** layer evaluates applications that bypass static identity checks. Instead of looking for a specific signature, the SDK evaluates two primary behavioral vectors: {% stepper %} {% step %} ### **Installation Source Evaluation** The application originates from an untrusted source. {% endstep %} {% step %} ### **Dangerous Permissions Evaluation** The application possesses specifically designated high-risk system privileges. {% endstep %} {% endstepper %} How these two vectors are logically combined depends entirely on your configured `reasonMode`, which is detailed in the [Heuristic Evaluation Logic](/freerasp/freemalwaredetection/detection-layers/behavioral-heuristics/heuristic-evaluation-logic.md) section. *** ## Installation Sources Whitelist The Android OS tracks the installer package name for every installed application. The SDK evaluates this identifier against your explicitly defined list of trusted sources to determine if the application originates from a trusted source. {% hint style="info" %} **Understanding Sideloading & App Origins** For deeper context on how installer identifiers work under the hood, read our Sideloading guide. It explains the technical differences between official store installs, OEM preloads, and raw APK sideloads. [**→ View the Sideloading section**](https://docs.talsec.app/appsec-articles/glossary/sideloading) {% endhint %} ### Evaluation Scope You can define exactly which applications are subjected to this check by adjusting the scan scope in your configuration: * `SIDELOADED_ONLY` *(default)*: Excludes all system applications and OEM pre-installed bloatware. Focuses exclusively on user-installed and sideloaded packages. * `SIDELOADED_AND_SYSTEM_EXCLUDE_OEM`: Scans sideloaded and system apps, but explicitly excludes OEM apps. * `SIDELOADED_AND_OEM`: Scans sideloaded apps plus vendor/OEM pre-installed bloatware. * `SIDELOADED_AND_SYSTEM_AND_OEM`: Scans all non-store apps — sideloaded, system, and OEM. * `ALL`: Evaluates every single application on the device, regardless of its origin.
Why filter OS-level packages? Factory-installed applications (e.g., manufacturer cameras, diagnostic tools, or system accessibility services) often possess highly elevated system privileges by design. If these apps were subjected to standard behavioral heuristics, they would generate a massive volume of false positives that represent safe, expected system behavior. By filtering out OS-level packages, the engine focuses exclusively on the realistic attack surface: user-installed and sideloaded packages where dangerous permission combinations are genuinely suspicious.
{% hint style="info" %} **No Hardcoded Stores** The SDK does not hardcode any trusted app stores. Failing to explicitly define trusted stores like Google Play (`com.android.vending`) will classify all standard user-installed apps as untrusted, drastically increasing false positives. {% endhint %} ### Common Installer Packages * `com.android.vending` — Google Play Store * `com.huawei.appmarket` — Huawei App Gallery * `com.google.android.packageinstaller` — Default system package installer (indicates a direct APK sideload) * `unknown` — Applications with a null installation source (ADB installs, local development builds) {% hint style="danger" %} **Local Testing Note** You can temporarily whitelist `unknown` or `com.google.android.packageinstaller` to bypass checks during local development via ADB, but these should **never** be whitelisted in production. {% endhint %} [**→ View how to configure trusted installation sources**](/freerasp/freemalwaredetection/integration-guide/configuration.md) *** ## Permission-Based Auditing This check evaluates the specific system privileges of the target application. You can define multiple sets of dangerous permissions. Structurally, the evaluation applies a logical `AND` to the permissions inside a single set, and a logical `OR` across different sets. An application must fully match at least one set to be flagged. ### Permission State The SDK provides granular control over how permissions are evaluated. You can configure the engine to check: * **Requested Permissions:** Evaluates any permission declared in the app's `AndroidManifest.xml`, regardless of whether the user has granted it yet. * **Granted Permissions:** Evaluates only the permissions actively granted by the user. If you populate both parameters, the engine applies a logical `OR` between them — the application is flagged if it matches either the requested sets `OR` the granted sets. ### Common High-Risk Permission Patterns When configuring your permission sets, use fully qualified [Android permission strings](https://developer.android.com/reference/android/Manifest.permission): * **OTP Stealers:** `android.permission.READ_SMS`, `android.permission.RECEIVE_SMS`, `android.permission.RECEIVE_WAP_PUSH` * **Overlay Trojans & Keyloggers:** `android.permission.BIND_ACCESSIBILITY_SERVICE` * **Screen-Locking Ransomware:** `android.permission.BIND_DEVICE_ADMIN`, `android.permission.SYSTEM_ALERT_WINDOW` * **Droppers:** `android.permission.REQUEST_INSTALL_PACKAGES` * **Surveillance Spyware:** `android.permission.QUERY_ALL_PACKAGES` [**→ View how to configure permission sets**](/freerasp/freemalwaredetection/integration-guide/configuration.md) *** ## Technical Reference For detailed execution logic, configuration modes, and a complete list of triggered result flags, refer to the following page: [**→ Continue to Heuristic Evaluation Logic**](/freerasp/freemalwaredetection/detection-layers/behavioral-heuristics/heuristic-evaluation-logic.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.talsec.app/freerasp/freemalwaredetection/detection-layers/behavioral-heuristics.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.