No single detection method holds up against modern Android malware. LAVAIQ runs four complementary layers, each contributing a different analytical perspective, so what one misses another catches.
Layer 01
Signature and hash comparison
Every Android app is signed by its developer, and SHA-256 or SHA-512 hashes can be computed from its contents. LAVAIQ compares those against a database of known malicious signatures. Near-perfect on known threats, useless against modified ones, which is exactly why it runs first, as a fast low-cost filter and never a solution on its own.
Layer 02
Permission anomaly detection
A contextual analysis of what an app asks for against what it claims to be. A flashlight app requesting SMS and call logs is a strong signal of intent with no signature involved. LAVAIQ keeps permission profiles for common app categories and scores deviations by severity and count.
Layer 03
Heuristic detection
Behavioural and structural features are matched against known malicious patterns by similarity rather than exact match, which catches unseen variants of known families. The rules were generated through AI analysis of malware, making this layer effective against obfuscated code whose surface has changed but whose structure has not.
Layer 04
Machine learning detection
The main research contribution. A neural network trained on curated benign and malicious applications, each reduced to a 100-dimensional feature vector and scored by a lightweight network of roughly 8,500 parameters into a continuous malice probability. Converted to TensorFlow Lite, it infers entirely on device.
Alongside the four
The Mesh
New signatures, malicious hashes, permission profiles and reputation data are pushed to every active installation, and each install acts as a node, so a threat seen anywhere informs everywhere. Real-time protection keeps this running in the background, triggering a full multi-layer analysis the moment a new app appears.
