Heuristic Analysis - Detecting Unknown Viruses

Overview

Some of the most persistent myths in computing relate to virus and anti-virus (AV) technology. The widely-held belief that AV software can only detect specific, known viruses has been around since the early days of AV research. It wasn't altogether true then; some of the first AV programs weren't intended to detect specific viruses, but rather to detect or block virus-like behavior, or suspicious changes in files. The aim of this paper is to reduce some of the confusion around the workings of AV technology, and to clarify what is realistic to expect from AV protection, particularly heuristic analysis.