I'm working on my thesis and I have a couple questions about differences between heuristics-based and behavioral malware detection.
Does heuristics-based detection rely only on statically examining malcode in order to find some kinds of instructions? Or maybe the anti-virus application has its own sandbox which can execute malicious code?
Is behavioral detection, which observes how the program is executed, done in a virtual machine like VirtualBox, or VMWare or is it done on a real machine?
I'm a little be confused because this article states that during Heuristics-based detection the program is emulated. What exactly does that mean? Does it mean what's I said above - that the AV app has its own, basic virtual machine?