Taking a look at the discription of both kinds, orientation seems the same. while it isn't the same I can't figure the difference. In a Heuristic scan it looks for suspicious or malicious behaviors in a file, Anomaly analysis looks for anomalies in a file and its structure.

| improve this question | | | | |

Search for anomaly is look for things that aren't bad per se, but usually isn't common. For instance, a freshly registered domain being accessed late night, and receiving lots of traffic. Or your HR computers accessing Github, or executing PowerShell scripts.

Those things are not wrong, they are out of place. Accessing Github is not wrong. But it's strange for certain group of users. In this case, an heuristic scanner would not find anything strange.

On the other hand, an anomaly detector needs a baseline. If you don't have a good baseline, you will either get a lot of false positives, and end up shutting down the scanner, or a lot of false negatives and will not be of any use.

| improve this answer | | | | |
  • Great answer. Does a heuristic scanner also needs a good baseline to deal with FP's FN's or is a heuristic scanner by nature more (not fully) resistant to these? – inter Apr 1 at 18:03
  • They need a baseline too, but it's easier to make. Binding a socket to cmd.exe, for example, is almost universally a bad thing. Acessing github? It heavily depends... – ThoriumBR Apr 1 at 18:12

It's the difference between "weird" and "bad".

Anomaly analysis looks for the "weird". There is no judgement about whether it is "bad". In a lot of contexts, weird = bad, but not always.

Heuristic analysis learns what is "bad" and looks for that, even if it turns out to be "normal".

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.