1

I'm struggling to see the difference as all papers and notes I've read seem to contradict each other.

Can someone please explain to me the difference between heuristic and behaviour based virus scanning techniques?

  • 2
    Please add the relevant parts from the papers which make you think that these are contradicting terms. In my opinion they are not contradicting but describe different aspects: behavior is what the code does at runtime while heuristics can both mark a specific type of behavior as suspicious but also static information like the use of packers. – Steffen Ullrich Apr 21 '17 at 10:32
  • I guess some state only state the behavioural aspects of heuristics, which make the differentiation between the two ambiguous. So from what I understand, heuristics can scan through code to detect uncommon anomalies, where behaviour-based detects the abnormal activity once the file has been run? – SwiftBeginner Apr 21 '17 at 11:00
  • 1
    Like I said, these are different aspects. It is not either heuristics or behavior but they can overlap. It's like comparing green fruits vs. apples. The difference not between heuristics and behavior analysis but between error-prone heuristics vs. fixed signatures of known-bad files and another one between dynamic analysis (behavior) vs. static analysis. – Steffen Ullrich Apr 21 '17 at 11:40
1

Though Heuristic detection is heavily use in computing, it is easier to learn the layman heuristic used in judgment and decision-making. Heuristic is first used by Amos Tversky and Daniel Kahneman to study human behaviour, to learn why human course of action base on particular criteria.

In layman term, Heuristic-based and Behaviour-based virus scanning is the same thing.

Preliminary heuristic based scanning will check files/script attributes/pattern or so call "behaviour/actions" to decide whether it is safe or malicious. So if the code are obfuscated, preliminary heuristic may miss it. So some background process is required to observe what the program will do during execution, stop it when it show some bad behavior. So some people call this as "behaviour scanning/checking".

While in fact, such active file execution still base on a set of heuristic to react. Most malware analyst just use the term "static analysis" and "dynamic analysis" to differentiate the two mechanism.

| improve this answer | |
1

As far as i'm concerned, heuristics based detection stills after all a kind of static analysis, the potential malware is scanned statically in order to find out suspicious properties like junk code or the use of uncommon APIs,WTHOUT relying on any signature match.

Behavior analysis/detection relies on examining how a given program executes in order to identify also "uncommon" activities like creating specific registry keys , altering HOST file, killing process or unpacking code..

| improve this answer | |
  • A heuristic-based approach may or may not use a binary's signature as a feature. It depends on the implementation – Soutzikevich Apr 29 at 11:52
  • @Soutzikevich your source? – Soufiane Tahiri May 5 at 11:49
1

Behaviour-based detection methods

These methods are based on observing the behaviour of a program (of an executable), to identify what it does. They try to see how the program behaves and then decide wether it is malicious or not. These methods overcome the shortcomings of signature-based ones. Multiple malware samples with the same behaviour can be classified under a single behaviour-signature.

Behaviour-based detection methods are particularly helpful in detecting malware that keep on generating different variants (e.g. Polymorphic Malware), because the variants will utilise system resources and services in a similar manner. To perform the dynamic analysis of the malware in a controlled environment, tools such as debuggers, simulators, emulators and sandboxes are used. However, with more sophisticated evasion and anti-detection techniques being incorporated increasingly into new malware, such as "environmental-awareness", even behaviour-based detection methods can be effectively bypassed.

The main disadvantages of these methods though, are their high False-Positive Ratio (FPR) and the high amount of scanning time required.

Heuristic-based detection methods

The word "Heuristic" comes directly from the Greek adjective "Eυρετικός", which means "someone who can find" (I guess an accurate translation would be "Finder").

These methods were reserached and developed in order to overcome the main disadvantages of both signature and behaviour based methods. Heuristic malware detection methods use data mining and machine learning techniques to learn the behaviour of an executable file. A machine learning model should theoretically be able to make the same (and more) detections than a behaviour-based approach, in much less time (assuming a post-development ML model).

Heuristic-based methods are distilled through deep analysis of the malware's features (either static or dynamic) and should not be confused with ML-based behavioural analysis. The main features used in heuristic detection throughout literature are API calls and system calls (and/or their sequence), the control flow of a program (through CFGs), OpCodes, Strings (or substrings) and other hybrid or novel (e.g. file content) features.


The information posted was taken from the paper "A Survey on Heuristic Malware Detection Techniques" by Zahra Bazrafshan, Hashem Hashemi, Seyed Mehdi Hazrati Fard, Ali Hamzeh and it can be found here.

I encourage you to read this paper if you are interested into learning more about the differences of the two approaches and about the feature-set used in a heuristic-based approach.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.