Google Brings EDR-Style Threat Detection to Android Devices

Google announced Live Threat Detection for Android, an on-device machine learning system that monitors application behavior in real time to identify zero-day exploits and novel attacks. The feature analyzes API calls, network requests, and file system access without transmitting data to servers. Running TensorFlow Lite models locally, it flags anomalous activity like unexpected permission requests or suspicious network connections, closing a gap between enterprise endpoint detection and consumer mobile security.