Behavioral Heuristics
The Behavioral Heuristics layer evaluates applications that bypass static identity checks. Instead of looking for a specific signature, the SDK evaluates two primary behavioral vectors:
How these two vectors are logically combined depends entirely on your configured reasonMode, which is detailed in the Heuristic Evaluation Logic section.
Installation Sources Whitelist
The Android OS tracks the installer package name for every installed application. The SDK evaluates this identifier against your explicitly defined list of trusted sources to determine if the application originates from a trusted source.
Understanding Sideloading & App Origins
For deeper context on how installer identifiers work under the hood, read our Sideloading guide. It explains the technical differences between official store installs, OEM preloads, and raw APK sideloads.
Evaluation Scope
You can define exactly which applications are subjected to this check by adjusting the scan scope in your configuration:
SIDELOADED_ONLY(default): Excludes all system applications and OEM pre-installed bloatware. Focuses exclusively on user-installed and sideloaded packages.SIDELOADED_AND_SYSTEM_EXCLUDE_OEM: Scans sideloaded and system apps, but explicitly excludes OEM apps.SIDELOADED_AND_OEM: Scans sideloaded apps plus vendor/OEM pre-installed bloatware.SIDELOADED_AND_SYSTEM_AND_OEM: Scans all non-store apps — sideloaded, system, and OEM.ALL: Evaluates every single application on the device, regardless of its origin.
Why filter OS-level packages?
Factory-installed applications (e.g., manufacturer cameras, diagnostic tools, or system accessibility services) often possess highly elevated system privileges by design. If these apps were subjected to standard behavioral heuristics, they would generate a massive volume of false positives that represent safe, expected system behavior.
By filtering out OS-level packages, the engine focuses exclusively on the realistic attack surface: user-installed and sideloaded packages where dangerous permission combinations are genuinely suspicious.
No Hardcoded Stores
The SDK does not hardcode any trusted app stores. Failing to explicitly define trusted stores like Google Play (com.android.vending) will classify all standard user-installed apps as untrusted, drastically increasing false positives.
Common Installer Packages
com.android.vending— Google Play Storecom.huawei.appmarket— Huawei App Gallerycom.google.android.packageinstaller— Default system package installer (indicates a direct APK sideload)unknown— Applications with a null installation source (ADB installs, local development builds)
Local Testing Note
You can temporarily whitelist unknown or com.google.android.packageinstaller to bypass checks during local development via ADB, but these should never be whitelisted in production.
→ View how to configure trusted installation sources
Permission-Based Auditing
This check evaluates the specific system privileges of the target application. You can define multiple sets of dangerous permissions.
Structurally, the evaluation applies a logical AND to the permissions inside a single set, and a logical OR across different sets. An application must fully match at least one set to be flagged.
Permission State
The SDK provides granular control over how permissions are evaluated. You can configure the engine to check:
Requested Permissions: Evaluates any permission declared in the app's
AndroidManifest.xml, regardless of whether the user has granted it yet.Granted Permissions: Evaluates only the permissions actively granted by the user.
If you populate both parameters, the engine applies a logical OR between them — the application is flagged if it matches either the requested sets OR the granted sets.
Common High-Risk Permission Patterns
When configuring your permission sets, use fully qualified Android permission strings:
OTP Stealers:
android.permission.READ_SMS,android.permission.RECEIVE_SMS,android.permission.RECEIVE_WAP_PUSHOverlay Trojans & Keyloggers:
android.permission.BIND_ACCESSIBILITY_SERVICEScreen-Locking Ransomware:
android.permission.BIND_DEVICE_ADMIN,android.permission.SYSTEM_ALERT_WINDOWDroppers:
android.permission.REQUEST_INSTALL_PACKAGESSurveillance Spyware:
android.permission.QUERY_ALL_PACKAGES
→ View how to configure permission sets
Technical Reference
For detailed execution logic, configuration modes, and a complete list of triggered result flags, refer to the following page:
Last updated