I'm struggling to see the difference as all papers and notes I've read seem to contradict each other.
Can someone please explain to me the difference between heuristic and behaviour based virus scanning techniques?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Though Heuristic detection is heavily use in computing, it is easier to learn the layman heuristic used in judgment and decision-making. Heuristic is first used by Amos Tversky and Daniel Kahneman to study human behaviour, to learn why human course of action base on particular criteria.
In layman term, Heuristic-based and Behaviour-based virus scanning is the same thing.
Preliminary heuristic based scanning will check files/script attributes/pattern or so call "behaviour/actions" to decide whether it is safe or malicious. So if the code are obfuscated, preliminary heuristic may miss it. So some background process is required to observe what the program will do during execution, stop it when it show some bad behavior. So some people call this as "behaviour scanning/checking".
While in fact, such active file execution still base on a set of heuristic to react. Most malware analyst just use the term "static analysis" and "dynamic analysis" to differentiate the two mechanism.
As far as i'm concerned, heuristics based detection stills after all a kind of static analysis, the potential malware is scanned statically in order to find out suspicious properties like junk code or the use of uncommon APIs,WTHOUT relying on any signature match.
Behavior analysis/detection relies on examining how a given program executes in order to identify also "uncommon" activities like creating specific registry keys , altering HOST file, killing process or unpacking code..
These methods are based on observing the behaviour of a program (of an executable), to identify what it does. They try to see how the program behaves and then decide wether it is malicious or not. These methods overcome the shortcomings of signature-based ones. Multiple malware samples with the same behaviour can be classified under a single behaviour-signature.
Behaviour-based detection methods are particularly helpful in detecting malware that keep on generating different variants (e.g. Polymorphic Malware), because the variants will utilise system resources and services in a similar manner. To perform the dynamic analysis of the malware in a controlled environment, tools such as debuggers, simulators, emulators and sandboxes are used. However, with more sophisticated evasion and anti-detection techniques being incorporated increasingly into new malware, such as "environmental-awareness", even behaviour-based detection methods can be effectively bypassed.
The main disadvantages of these methods though, are their high False-Positive Ratio (FPR) and the high amount of scanning time required.
The word "Heuristic" comes directly from the Greek adjective "Eυρετικός", which means "someone who can find" (I guess an accurate translation would be "Finder").
These methods were reserached and developed in order to overcome the main disadvantages of both signature and behaviour based methods. Heuristic malware detection methods use data mining and machine learning techniques to learn the behaviour of an executable file. A machine learning model should theoretically be able to make the same (and more) detections than a behaviour-based approach, in much less time (assuming a post-development ML model).
Heuristic-based methods are distilled through deep analysis of the malware's features (either static or dynamic) and should not be confused with ML-based behavioural analysis. The main features used in heuristic detection throughout literature are API calls and system calls (and/or their sequence), the control flow of a program (through CFGs), OpCodes, Strings (or substrings) and other hybrid or novel (e.g. file content) features.
The information posted was taken from the paper "A Survey on Heuristic Malware Detection Techniques" by Zahra Bazrafshan, Hashem Hashemi, Seyed Mehdi Hazrati Fard, Ali Hamzeh and it can be found here.
I encourage you to read this paper if you are interested into learning more about the differences of the two approaches and about the feature-set used in a heuristic-based approach.