A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where "virus" includes trojans, rootkits, et al.)

This does not help when defending against zero-days and active intrusions. By definition they have no known signature. What do you call an antivirus that instead responds to suspicious activity (rather than known signatures)?

  • 8
    I was really hoping for a witty punchline... Commented Nov 7, 2017 at 14:23
  • A smart sysadmin?! Commented Nov 7, 2017 at 15:05
  • I call them commercial malware because you pay for them (usually "scan" is free whereas "realtime protection" costs money) and they're the kind of software that tends to either make your computer 20% slower for no good reason or fuck up the entire system beyond usability. In my opinion, these programs are worse than the malware that they presumably prevent (is there any evidence they do, anyway?). But that's just me.
    – Damon
    Commented Nov 7, 2017 at 15:39
  • I don't know, what do you call an antivirus that detects suspicious activity?
    – user81147
    Commented Nov 7, 2017 at 16:03

2 Answers 2


The traditional technique described sounds like a signature- and host-based intrusion detection system. (IDS is a broad term that includes antivirus software.)

Some systems detect known patterns of bad behaviour, in addition to known bad data. These pattern definitions are not dynamic, so you might still consider them to be "signatures". In consumer antiviruses this feature is sometimes included under the umbrella term "real-time protection".

A dynamic (non-signature) implementation would be called an anomaly-based IDS. This relies on machine learning to generate heuristics that are used to detect suspicious behaviour.


Virus scanners that look for suspicious activity are often referred to as using heuristic analysis. It may run an application in some sort of sandbox (a special virtual machine) to analyse the program's behaviour. It will look for common virus activity such as replication and attempts to conceal itself.

As new viruses are discovered, antivirus manufacturers may add the virus behaviours to the rules engine, so that future variants are also discovered.

Further reading

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .