Glossary

Heuristic analysis

Heuristic analysis is a method used by antivirus software to identify potentially harmful software by examining the behaviour and characteristics of programs.

Instead of relying solely on known malware signatures, which can only detect previously identified threats, heuristic analysis looks for patterns or activities that are typical of malicious behaviour.

Here’s how it works:

  • Code Examination: The antivirus software analyses the code of a program, looking for suspicious elements or commands that are often found in malware, such as self-replication or code obfuscation.
  • Behavioural Analysis: It observes how the program behaves when it runs. If the program attempts actions like modifying system files, accessing large numbers of files, or communicating with unknown external servers, it could be flagged as suspicious.
  • Sandboxing: The program might be executed in a controlled, isolated environment (a sandbox) where its behaviour can be safely observed without risking the actual system.
  • Pattern Recognition: The software uses algorithms to recognize patterns and similarities with known malware. This helps in identifying new, previously unknown threats.
  • Heuristic analysis is particularly valuable because it can detect new and emerging threats that haven't yet been catalogued in the antivirus's signature database. However, it can sometimes result in false positives, where legitimate software is mistakenly identified as malicious.

Glossary

Dive into Exclusive Networks' comprehensive Cybersecurity & IT Glossary.

Back to Glossary

Knowledge Base

Stay current with new ideas, reports and keep informed on the latest cybersecurity trends.

Knowledge Base

Start growing your business

Whether you need a quote, advice, want to become a partner, or want to take advantage of our global services, we are here to help.

Get in touch