Google Takes on Android Malware with AI-Powered Live Threat Detection Service

Google is preparing to launch a new system to help solve the malware problem on Android. Its new live threat detection service leverages Google Play Protect’s in-device AI to scan apps for malicious behavior. The service, announced Tuesday following the Google I/O developer event, examines various signals related to an app’s use of sensitive permissions and interactions with other apps and services, the company says.

If it detects suspicious behavior, Google Play Protect may send the app to Google for further review and notify all users who have the app installed, or even disable the app, if warranted.

Detection also takes advantage of Google’s Private Compute Core, the Android privacy infrastructure introduced in 2022 that provides an isolated data processing environment within the Android operating system. The idea of ​​Private Compute Core, or PCC, is to allow users to control if, how and when their data is shared. Using PCC, the new live threat detection feature can protect users without collecting their data.

Google says it will roll out the system later this year to Google Pixel devices. Other manufacturers will join it, including Oppo, Honor, Lenovo, OnePlus, Nothing, Transsion, Sharp, etc.

The service could help Android users feel more comfortable downloading and using apps from Google Play, even if they would probably prefer not to have downloaded malware in the first place. Instead, they want malicious apps to be detected during app review. This is an area of ​​focus for Apple, which regularly touts the benefits of its App Store to consumers and developers. Although bad actors often slip through the cracks, it weeds out many more with its more intensive review system before allowing them to go live on the App Store. Before I/O, Apple announced that it had stopped a $1.8 billion fraud on the App Store, for example.

In addition to the live threat detection service, Google said it will hide one-time passwords in notifications to reduce a common attack vector for fraud and spyware. It will also expand Android 13’s restricted settings, which will now require additional user approval to enable app permissions when they sideload apps on their device.

We are launching a newsletter on AI! Register here to start receiving it in your inboxes on June 5.