Google Play Protect is a unified security system for Android. It is part of the set of Google services (Google Play Services) and aims to protect against malware the devices that use the mobile system, which number in the hundreds of millions.

Google (and its partners in the App Defense Alliance) have put a lot of effort into controlling malware on the platform. But – as with Windows – this is not easy in the face of a huge ecosystem. The situation is complicated when the authors of malicious apps promoted outside of Google Play resort to artificial intelligence and polymorphic malware that changes identifiable information in the application bypass automated security platforms and render these controls ineffective.

Google announced new real-time scanning features for Google Play Protect with which it hopes to make it more difficult for malicious applications that use polymorphism to avoid detection. This represents an important step to improve security for all Android users and aims to reduce the incidence of malware infections on the platform.

Real-time scanning in Google Play Protect

The tool works for apps downloaded from Google Play, the official Android app store, and APKs (Android packages) downloaded from external sources and third-party app stores. However, once malicious apps are installed on a user’s device, they obtain additional code from an external source to complete their functionality in a subsequent verification phase, where there are no mechanisms to stop them. And there are quite a few of them, even those that sneak into the official Play Store itself.

New real-time scanning features allow you to extract application behavior signals. They will be sent to the infrastructure backend of Play Protect for code-level in-depth analysis and returns results about the app’s security. “Our security protections and machine learning algorithms learn from every app submitted to Google for review, and we analyze thousands of signals and compare app behavior.”Google explains.

The improved Play Protect scanner will use static and dynamic analysis along with heuristics and machine learning to identify patterns indicative of malicious activity. This new system should reduce the amount of undetected malware, at least until malware authors modify their techniques to trick or evade scans.

Real-time code-level scanning in Google Play Protect is now available in India and other select countries, and will be rolled out globally in the coming months.