I'm struggling to see the difference as all papers and notes I've read seem to contradict each other.

Can someone please explain to me the difference between heuristic and behaviour based virus scanning techniques?

  • 1
    Please add the relevant parts from the papers which make you think that these are contradicting terms. In my opinion they are not contradicting but describe different aspects: behavior is what the code does at runtime while heuristics can both mark a specific type of behavior as suspicious but also static information like the use of packers. – Steffen Ullrich Apr 21 '17 at 10:32
  • I guess some state only state the behavioural aspects of heuristics, which make the differentiation between the two ambiguous. So from what I understand, heuristics can scan through code to detect uncommon anomalies, where behaviour-based detects the abnormal activity once the file has been run? – SwiftBeginner Apr 21 '17 at 11:00
  • 1
    Like I said, these are different aspects. It is not either heuristics or behavior but they can overlap. It's like comparing green fruits vs. apples. The difference not between heuristics and behavior analysis but between error-prone heuristics vs. fixed signatures of known-bad files and another one between dynamic analysis (behavior) vs. static analysis. – Steffen Ullrich Apr 21 '17 at 11:40

As far as i'm concerned, heuristics based detection stills after all a kind of static analysis, the potential malware is scanned statically in order to find out suspicious properties like junk code or the use of uncommon APIs,WTHOUT relying on any signature match.

Behavior analysis/detection relies on examining how a given program executes in order to identify also "uncommon" activities like creating specific registry keys , altering HOST file, killing process or unpacking code..


Though Heuristic detection is heavily use in computing, it is easier to learn the layman heuristic used in judgment and decision-making. Heuristic is first used by Amos Tversky and Daniel Kahneman to study human behaviour, to learn why human course of action base on particular criteria.

In layman term, Heuristic-based and Behaviour-based virus scanning is the same thing.

Preliminary heuristic based scanning will check files/script attributes/pattern or so call "behaviour/actions" to decide whether it is safe or malicious. So if the code are obfuscated, preliminary heuristic may miss it. So some background process is required to observe what the program will do during execution, stop it when it show some bad behavior. So some people call this as "behaviour scanning/checking".

While in fact, such active file execution still base on a set of heuristic to react. Most malware analyst just use the term "static analysis" and "dynamic analysis" to differentiate the two mechanism.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.