I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "rule-based" detection is or how it works.

This article describes rule-based detection as follows:

Nearly all nowadays utilized heuristic approaches implement rule-based systems. This means, that the component of the heuristic engine that conducts the analysis (the analyser) extracts certain rules from a file and this rules will be compared against a set of rule for malicious code. If there matches a rule, an alarm can be triggered.

I just don't understand what a "rule" is in this context. How is it different from any other signature. If it is one of the many characteristics that may be used in weight-based detection, how is this approach significantly different than that?

1 Answer 1


The assumption behind "rules based" detection of malware is that malware often behave in a certain manner that would be anomalous for clean, legitimate programs. Examples of rules or behavior that may tell a a system is infected by malware are below.

  1. A system process that drops various malware executables (e.g: Dropper)
  2. A system process that reaches out to random, and often foreign IP addresses / domains
  3. Repeated attempts to monitor or modify key system settings such as registry keys

A rule in this context refers to the anticipated behavior that classic malware tends to exhibit. Therefore, when a antivirus program encounters such anomalous behavior, it may be more likely than not , but not definite that the system is infected by malware.

Given rules based analysis relies on differentiating expected vs anomalous behavior, such algorithms can suffer when malware changes or "cloaks" itself so its "footprints" or behavior are hidden. In addition, single occurrences are often not significant but its repeated instances that often trigger "rules based" alarms, such as > than X # of times to connect to a particular IP address (such as for call back purposes).

  • 1
    So is the main difference between this and weight-based detection that a single characteristic or behavior is what sets of the rather than an ensemble of characteristics? I also noticed that all your examples were behavior-based. Do these rules solely or typically based on behavior?
    – chillsauce
    Commented Jul 29, 2019 at 0:48
  • 1
    Yes, rules are typically based on anomalous behavior that legitimate files often do not exhibit. Such behavior by clean files may be normal but typically would be unusual in the given context of the file or application
    – Anthony
    Commented Jul 29, 2019 at 1:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .