5

In one local magazine I read interview with Adrian Porcescu, who is a technical consultant that works for Kaspersky Lab.

Among other things, he says their anti-virus uses behaviourism and heuristic control to detect malicious software.

I wonder - what is behaviourism and heuristic control in anti-virus software and how does it work?

3
  • 2
    This is a very large topic. I recommend looking up white-papers on the topic (i.e. the eset paper at google.com/… )
    – Ormis
    Commented Jul 20, 2011 at 21:53
  • This is a very broad topic. Could you ask a more specific question? Are you looking for theory or practice?
    – this.josh
    Commented Jul 20, 2011 at 23:17
  • @this.josh: Of course, if possible I would much more like practice then theory. However, theory is also fine. To be perfectly honest, I don't know how to ask specific question simply because I don't know what are heurisrics in behaviourism in AV industry. I found tons of information what are they in psyhology, but it doesn't have much with IT (e.g. heuristic approach to problem - if you don't know how to deal with problem, draw yourself a picture).
    – StupidOne
    Commented Jul 21, 2011 at 7:13

1 Answer 1

8

Heuristic are:

  • learning techniques
  • common sense
  • discoveries

Their objective is to recognise a virus by analysing its code (not limited to). If a program is programmed to open a certain file, or to load/read certain memory address. These methods are based on multiple criteria. They eventually can run program in virtual environment to monitor for known virus schemes : replication, stealth etc.

Behaviourism is analysis in real time. By analysing what a program is doing (file I/O, memory I/O, network I/O, use of the PC during idle time, ...) you can assess whether it is legitimate or not. If one program begins firing packet on 100 IP addresses on each port, you can be sure it's a virus, because it is not a normal behaviour for a program.

I would conclude saying this: behaviourism deals with unknown behaviour (certainly try to profile the user behaviour to detect changes in normal activity) and it certainly uses heuristic. Heuristics objective is to detect an unknown virus, or variant, but the scheme they are looking for are well known.

Some references:

3
  • Great attempt to answer a difficult question. Do you have any references you could list?
    – this.josh
    Commented Jul 20, 2011 at 23:15
  • I've added some I've found when trying to answer. It's difficult to find a good source of information to justify all of the points. But as you said: it's a difficult question. I think that maybe the two techniques are sometimes overlapping.
    – M'vy
    Commented Jul 21, 2011 at 8:10
  • This was more than 10 years ago, and I did not copy the name of the article, so I doubt I can find it again (mostly because I can't remember what it was)
    – M'vy
    Commented May 29, 2022 at 9:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .