I'm struggling to see the difference as all papers and notes I've read seem to contradict each other.

Can someone please explain to me the difference between heuristic and behaviour based virus scanning techniques?

  • 2
    Please add the relevant parts from the papers which make you think that these are contradicting terms. In my opinion they are not contradicting but describe different aspects: behavior is what the code does at runtime while heuristics can both mark a specific type of behavior as suspicious but also static information like the use of packers. Commented Apr 21, 2017 at 10:32
  • I guess some state only state the behavioural aspects of heuristics, which make the differentiation between the two ambiguous. So from what I understand, heuristics can scan through code to detect uncommon anomalies, where behaviour-based detects the abnormal activity once the file has been run? Commented Apr 21, 2017 at 11:00
  • 1
    Like I said, these are different aspects. It is not either heuristics or behavior but they can overlap. It's like comparing green fruits vs. apples. The difference not between heuristics and behavior analysis but between error-prone heuristics vs. fixed signatures of known-bad files and another one between dynamic analysis (behavior) vs. static analysis. Commented Apr 21, 2017 at 11:40

4 Answers 4


Heuristic and behavioural detection approaches are different categories to describe detection and not mutually exclusive.

Behavioural detection is based on events that are being monitored. Certain combinations of those events lead to a detection. The thing that describes those combinations is called a signature.

Heuristic methods in general describe "a practical method that is not guaranteed to be optimal, perfect, or rational, but is nevertheless sufficient for reaching an immediate, short-term goal or approximation" (from Wikipia). In the context of malware detection, we describe risky, false positive prone detection approaches as heuristic.

To sum up: Behavoural detection describes what source of information is being used for detection whereas heuristic detection describes how the information is processed to form a decision.

Behavioural detection can be heuristic, but doesn't have to be. There are many behavioural signatures that are very specific to certain malware and not heuristic at all.


Though Heuristic detection is heavily use in computing, it is easier to learn the layman heuristic used in judgment and decision-making. Heuristic is first used by Amos Tversky and Daniel Kahneman to study human behaviour, to learn why human course of action base on particular criteria.

In layman term, Heuristic-based and Behaviour-based virus scanning is the same thing.

Preliminary heuristic based scanning will check files/script attributes/pattern or so call "behaviour/actions" to decide whether it is safe or malicious. So if the code are obfuscated, preliminary heuristic may miss it. So some background process is required to observe what the program will do during execution, stop it when it show some bad behavior. So some people call this as "behaviour scanning/checking".

While in fact, such active file execution still base on a set of heuristic to react. Most malware analyst just use the term "static analysis" and "dynamic analysis" to differentiate the two mechanism.


As far as I'm concerned, heuristics-based detection is still, after all, a kind of static analysis. The potential malware is scanned statically in order to find out suspicious properties like junk code or the use of uncommon APIs, without relying on any signature match.

Behavior analysis/detection relies on examining how a given program executes in order to identify also "uncommon" activities like creating specific registry keys, altering the HOST file, killing processes, or unpacking code.

  • A heuristic-based approach may or may not use a binary's signature as a feature. It depends on the implementation Commented Apr 29, 2020 at 11:52
  • @Soutzikevich your source? Commented May 5, 2020 at 11:49

Behaviour-based detection methods

These methods are based on observing the behaviour of a program (of an executable), to identify what it does. They try to see how the program behaves and then decide wether it is malicious or not. These methods overcome the shortcomings of signature-based ones. Multiple malware samples with the same behaviour can be classified under a single behaviour-signature.

Behaviour-based detection methods are particularly helpful in detecting malware that keep on generating different variants (e.g. Polymorphic Malware), because the variants will utilise system resources and services in a similar manner. To perform the dynamic analysis of the malware in a controlled environment, tools such as debuggers, simulators, emulators and sandboxes are used. However, with more sophisticated evasion and anti-detection techniques being incorporated increasingly into new malware, such as "environmental-awareness", even behaviour-based detection methods can be effectively bypassed.

The main disadvantages of these methods though, are their high False-Positive Ratio (FPR) and the high amount of scanning time required.

Heuristic-based detection methods

The word "Heuristic" comes directly from the Greek adjective "Eυρετικός", which means "someone who can find" (I guess an accurate translation would be "Finder").

These methods were reserached and developed in order to overcome the main disadvantages of both signature and behaviour based methods. Heuristic malware detection methods use data mining and machine learning techniques to learn the behaviour of an executable file. A machine learning model should theoretically be able to make the same (and more) detections than a behaviour-based approach, in much less time (assuming a post-development ML model).

Heuristic-based methods are distilled through deep analysis of the malware's features (either static or dynamic) and should not be confused with ML-based behavioural analysis. The main features used in heuristic detection throughout literature are API calls and system calls (and/or their sequence), the control flow of a program (through CFGs), OpCodes, Strings (or substrings) and other hybrid or novel (e.g. file content) features.

The information posted was taken from the paper "A Survey on Heuristic Malware Detection Techniques" by Zahra Bazrafshan, Hashem Hashemi, Seyed Mehdi Hazrati Fard, Ali Hamzeh and it can be found here.

I encourage you to read this paper if you are interested into learning more about the differences of the two approaches and about the feature-set used in a heuristic-based approach.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .