I'm working on my thesis and I have a couple questions about differences between heuristics-based and behavioral malware detection.

Does heuristics-based detection rely only on statically examining malcode in order to find some kinds of instructions? Or maybe the anti-virus application has its own sandbox which can execute malicious code?

Is behavioral detection, which observes how the program is executed, done in a virtual machine like VirtualBox, or VMWare or is it done on a real machine?

I'm a little be confused because this article states that during Heuristics-based detection the program is emulated. What exactly does that mean? Does it mean what's I said above - that the AV app has its own, basic virtual machine?

  • 1
    Virtual machines do not have to be a full VM. The term you are looking for is "sandbox". – schroeder Dec 29 '18 at 13:36
  • The article says: "emulate running the file" not that "the program is emulated". – schroeder Dec 29 '18 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.