Heuristic analysis

This article is about antivirus software. For the use of heuristics in usability evaluation, see Heuristic evaluation.

Heuristic analysis is a method employed by many computer antivirus programs designed to detect previously unknown computer viruses, as well as new variants of viruses already in the "wild".

In the context of antivirus software, heuristic analysis relies on experience-based techniques and rules of thumb to identify malware, rather than relying strictly on exact signature matches.

Operation

Most antivirus programs that utilize heuristic analysis perform this function by executing the programming commands of a questionable program or script within a specialized virtual machine, thereby allowing the anti-virus program to internally simulate what would happen if the suspicious file were to be executed while keeping the suspicious code isolated from the real-world machine. It then analyzes the commands as they are performed, monitoring for common viral activities such as replication, file overwrites, and attempts to hide the existence of the suspicious file. If one or more virus-like actions are detected, the suspicious file is flagged as a potential virus, and the user alerted.

Another common method of heuristic analysis is static analysis, where the antivirus program disassembles the suspicious program to analyze the machine code contained within. Instead of looking for exact signature matches, the engine scans for specific instruction sequences, commands, or patterns that are highly characteristic of malware (such as searching for specific files, altering the registry, or injecting code into other processes). If enough suspicious patterns are detected, the file is flagged, and the user is alerted.

Effectiveness

Heuristic analysis is capable of detecting many previously unknown viruses and new variants of current viruses. However, heuristic analysis operates on the basis of experience (by comparing the suspicious file to the code and functions of known viruses). This means it is likely to miss new viruses that contain previously unknown methods of operation not found in any known viruses. Hence, the effectiveness is fairly low regarding accuracy and the number of false positives.

As new viruses are discovered by human researchers, information about them is added to the heuristic analysis engine, thereby providing the engine the means to detect new viruses.

External links

• Retrospective/proActive antivirus test from AV-Comparatives.org