I'm struggling to see the difference as all papers and notes I've read seem to contradict each other.
Can someone please explain to me the difference between heuristic and behaviour based virus scanning techniques?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
As far as i'm concerned, heuristics based detection stills after all a kind of static analysis, the potential malware is scanned statically in order to find out suspicious properties like junk code or the use of uncommon APIs,WTHOUT relying on any signature match.
Behavior analysis/detection relies on examining how a given program executes in order to identify also "uncommon" activities like creating specific registry keys , altering HOST file, killing process or unpacking code..
Though Heuristic detection is heavily use in computing, it is easier to learn the layman heuristic used in judgment and decision-making. Heuristic is first used by Amos Tversky and Daniel Kahneman to study human behaviour, to learn why human course of action base on particular criteria.
In layman term, Heuristic-based and Behaviour-based virus scanning is the same thing.
Preliminary heuristic based scanning will check files/script attributes/pattern or so call "behaviour/actions" to decide whether it is safe or malicious. So if the code are obfuscated, preliminary heuristic may miss it. So some background process is required to observe what the program will do during execution, stop it when it show some bad behavior. So some people call this as "behaviour scanning/checking".
While in fact, such active file execution still base on a set of heuristic to react. Most malware analyst just use the term "static analysis" and "dynamic analysis" to differentiate the two mechanism.