How Does Antivirus Software Work? A Guide to Virus Detection Methods

You know that you need antivirus protection. For the typical computer user, it’s usually the best line of defense against losing data and equipment to malware infections. For businesses, antivirus software is one of several defensive tactics designed to keep the network and sensitive data safe.
But have you ever thought about how antivirus really works? When you’re comparing antivirus products to choose the best antivirus program for your needs, you might see terms like “heuristic” detection or sandboxing in antivirus descriptions, but what do they mean? And which one is best for your organization? The first step is to understand how each type of detection works.

Signature-Based Detection

Signature-based detection is the backbone of most antivirus programs. Essentially, this type of detection creates a database of sorts detailing the signatures of known malware. The antivirus program automatically checks new programs and applications against the known malware signatures in the database, and if the signatures match, then the program is blocked.

The signature database is constantly updated, since cybercriminals are constantly developing new codes to thwart the antivirus protection. That’s why antivirus software that relies strictly on signature-based detection is generally considered the bare minimum in protection, and should only be used temporarily until additional protections can be installed.

Heuristics

Antivirus protection based on heuristics is similar to signature-based detection, but is better suited to detecting new malware that may not have been listed in the database of known viruses yet. Heuristics examines new programs for characteristics that are common in known viruses, even though the program itself may not have an exact match in the database.

In some cases, the antivirus program may try to run the new program in the background to see what it does, or look for suspicious code. Heuristics analyzes the code structure for anomalies, but because it blocks programs based on characteristics, not known behavior, there is a risk that it will block legitimate programs as well.

Behavioral Detection

One of the most advanced forms of virus detection is behavioral based detection. This type of virus detection evaluates code by observing how the program executes. It looks for suspicious behaviors, like observing keystrokes, that aren’t typical of program behaviors. The drawback to behavioral detection is that it doesn’t really work until the malware is installed and has begun performing its nefarious tasks.

On the positive side, though, when taken together with other antivirus detection types, behavioral detection continues to keep your machine safe from malware even after the initial evaluation. If you inadvertently install malware that isn’t blocked by signature detection, behavioral detection can protect you thanks to its ability to spot problematic behaviors.

Blacklisting and Whitelisting

Some antivirus programs rely on the listing of programs to protect machines. Blacklisting means blocking anything that comes from a specific domain, IP address, or contains specific types of code. Whitelisting is the opposite; only those programs that are listed on the white list will be allowed to run. Many large companies use this approach on employee machines to keep the network safe.

Sandboxing

Sandboxing is a very rare approach in consumer antivirus products, but is quite effective, despite being somewhat cumbersome and slow. With sandboxing, the new programs are run in a virtual environment, where they are evaluated for suspicious or dangerous behaviors using heuristic and behavioral techniques. If the program completes harmful tasks, it’s blocked.

Because each form of virus protection has strengths and weaknesses, the best option is to choose a program that combines several methods to offer the most complete security solution. Keep in mind that many programs use terms like “heuristics-based” and “behavioral-based” interchangeably, and that the lines are often blurred. When combined with signature-based detection and listing, either form of detection can be effective.

Also, many antivirus programs are now cloud-based. Cloud-based detection has several benefits, not the least of which is that detection takes place away from the local machine, which maintains processing speed. And because the cloud detection protects many users at once, it gets stronger based on the experiences of all users. In other words, when the cloud engine detects a potentially harmful signature on one machine, that signature is then added to the database to protect all of the other machines protected by that program. This improves the overall security for everyone.

The bottom line, though, is to choose an antivirus program that combines several techniques. When you do, you can rest easy that there is little chance that your computer will be infected by malware.