What do you call an antivirus that detects suspicious activity?

Question

A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where "virus" includes trojans, rootkits, et al.)

This does not help when defending against zero-days and active intrusions. By definition they have no known signature. What do you call an antivirus that instead responds to suspicious activity (rather than known signatures)?

I call them commercial malware because you pay for them (usually "scan" is free whereas "realtime protection" costs money) and they're the kind of software that tends to either make your computer 20% slower for no good reason or fuck up the entire system beyond usability. In my opinion, these programs are worse than the malware that they presumably prevent (is there any evidence they do, anyway?). But that's just me. — Damon, Nov 07 '17 at 15:39
I don't know, what _do_ you call an antivirus that detects suspicious activity? — , Nov 07 '17 at 16:03

score 2 · Accepted Answer · answered Nov 07 '17 at 13:03

The traditional technique described sounds like a signature- and host-based intrusion detection system. (IDS is a broad term that includes antivirus software.)

Some systems detect known patterns of bad behaviour, in addition to known bad data. These pattern definitions are not dynamic, so you might still consider them to be "signatures". In consumer antiviruses this feature is sometimes included under the umbrella term "real-time protection".

A dynamic (non-signature) implementation would be called an anomaly-based IDS. This relies on machine learning to generate heuristics that are used to detect suspicious behaviour.

score 2 · Answer 2 · answered Nov 07 '17 at 13:43

Virus scanners that look for suspicious activity are often referred to as using heuristic analysis. It may run an application in some sort of sandbox (a special virtual machine) to analyse the program's behaviour. It will look for common virus activity such as replication and attempts to conceal itself.

As new viruses are discovered, antivirus manufacturers may add the virus behaviours to the rules engine, so that future variants are also discovered.

What do you call an antivirus that detects suspicious activity?

2 Answers2