Problem solve Get help with specific problems with your technologies, process and projects.

How antivirus software works: Virus detection techniques

Antivirus software uses several different virus detection techniques, as described in this tip by expert Lenny Zeltser.

Listen to this tip as an MP3

Download How antivirus works: Virus detection techniques as an MP3 file.

An antivirus tool is an essential component of most antimalware suites. It must identify known and previously unseen malicious files with the goal of blocking them before they can cause damage. Though tools differ in the implementation of malware-detection mechanisms, they tend to incorporate the same virus detection techniques. Familiarity with these techniques can help you understand how antivirus software works.

Virus detection techniques can be classified as follows:

  • Signature-based detection uses key aspects of an examined file to create a static fingerprint of known malware. The signature could represent a series of bytes in the file. It could also be a cryptographic hash of the file or its sections. This method of detecting malware has been an essential aspect of antivirus tools since their inception; it remains a part of many tools to date, though its importance is diminishing. A major limitation of signature-based detection is that, by itself, this method is unable to flag malicious files for which signatures have not yet been developed. With this in mind, modern attackers frequently mutate their creations to retain malicious functionality by changing the file’s signature.
  • Heuristics-based detection aims at generically detecting new malware by statically examining files for suspicious characteristics without an exact signature match. For instance, an antivirus tool might look for the presence of rare instructions or junk code in the examined file. The tool might also emulate running the file to see what it would do if executed, attempting to do this without noticeably slowing down the system. A single suspicious attribute might not be enough to flag the file as malicious. However, several such characteristics might exceed the expected risk threshold, leading the tool to classify the file as malware. The biggest downside of heuristics is it can inadvertently flag legitimate files as malicious.
  • Behavioral detection observes how the program executes, rather than merely emulating its execution. This approach attempts to identify malware by looking for suspicious behaviors, such as unpacking of malcode, modifying the hosts file or observing keystrokes. Noticing such actions allows an antivirus tool to detect the presence of previously unseen malware on the protected system. As with heuristics, each of these actions by itself might not be sufficient to classify the program as malware. However, taken together, they could be indicative of a malicious program. The use of behavioral techniques brings antivirus tools closer to the category of host intrusion prevention systems (HIPS), which have traditionally existed as a separate product category.
  • Cloud-based detection identifies malware by collecting data from protected computers while analyzing it on the provider’s infrastructure, instead of performing the analysis locally. This is usually done by capturing the relevant details about the file and the context of its execution on the endpoint, and providing them to the cloud engine for processing. The local antivirus agent only needs to perform minimal processing. Moreover, the vendor’s cloud engine can derive patterns related to malware characteristics and behavior by correlating data from multiple systems. In contrast, other antivirus components base decisions mostly on locally observed attributes and behaviors. A cloud-based engine allows individual users of the antivirus tool to benefit from the  experiences of other members of the community.

Though the approaches above are listed under individual headings, the distinctions between various techniques are often blurred. For instance, the terms "heuristics-based" and "behavioral detection" are often used interchangeably. In addition, these methods -- as well as signature detection -- tend to play an active role when the tool incorporates cloud-based capabilities. To keep up with the intensifying flow of malware samples, antivirus vendors have to incorporate multiple layers into their tools; relying on a single approach is no longer a viable option.

More from Lenny Zeltser on antimalware

About the author:
Lenny Zeltser is a seasoned information security professional with a strong background in online threats and defenses. He teaches malware combat courses at SANS Institute. Send comments on this article to

This was last published in October 2011

Dig Deeper on Malware, virus, Trojan and spyware protection and removal

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

Whenever I search for the Virus detection methods, all I see everywhere is a single line: "Run a scan using your Anti-Virus." This is something new. And if you do not know on BadUSB, its time you should. This is a virus designed that couldn't be caught by any software and cannot be removed. Details can be verified at