Originally posted on Android Developer Blog
But, sometimes devices stop checking up with Verify apps. This may happen for a non-security related reason, like buying a new phone, or, it could mean something more concerning is going on. When a device stops checking up with Verify apps, it is considered Dead or Insecure (DOI). An app with a high enough percentage of DOI devices downloading it, is considered a DOI app. We use the DOI metric, along with the other security systems to help determine if an app is a PHA to protect Android users. Additionally, when we discover vulnerabilities, we patch Android devices with our security update system. This blog post explores the Android Security team’s research to identify the security-related reasons that devices stop working and prevent it from happening in the future.
With these factors in mind, we then focus on ‘retention’. A device is considered retained if it continues to perform periodic Verify apps security check ups after an app download. If it doesn’t, it’s considered potentially dead or insecure (DOI). An app’s retention rate is the percentage of all retained devices that downloaded the app in one day. Because retention is a strong indicator of device health, we work to maximize the ecosystem’s retention rate. Therefore, we use an app DOI scorer, which assumes that all apps should have a similar device retention rate. If an app’s retention rate is a couple of standard deviations lower than average, the DOI scorer flags it. A common way to calculate the number of standard deviations from the average is called a Z-score. The equation for the Z-score is below.
Difference between a regular and DOI app download on the same device.
Results in the wild
The DOI scorer and all of Android’s anti-malware work is one of multiple layers protecting users and developers on Android. For an overview of Android’s security and transparency efforts, check out our page.