Fighting malware and spam

Heuristics

Malware detection method using rules and pattern-matching

Heuristics is a term that refers to any method of detecting unknown malware using systems of rules and patterns. Most anti-malware products use some form of heuristics to supplement signature-based detection, improving detection and efficiency.

Malware that is not detected exactly using signatures may be compared to a set of rules which determine if a file meets any suspicious criteria. Use of certain coding techniques, behaviours or even phrases may be considered suspicious, and a combination of suspicions may be enough to alert on a file.

Some products allow considerable fine-tuning of the 'paranoia' level of their heuristics, particularly in server or mail gateway products which can safely allow suspect items to be blocked for some time pending further analysis.

Poll

VB2009