How Antivirus Software Works ?
Antivirus programs are powerful pieces of software that are essential on Windows computers. If you have ever wondered how antivirus programs detect viruses.
Signature based detection :-
Signature based detection is the most common method that antivirus software uses to identify malware. This method is somewhat limited by the fact that it can only identify a limited amount of emerging threats, e.g. generic, or extremely broad, signatures.
The suspicious behavior approach, by contrast, does not attempt to identify known viruses, but instead monitors the behavior of all programs. If one program tries to write data to an executable program, for example, the antivirus software can flag this suspicious behavior, alert a user, and ask what to do.
Heuristics ( Anomaly Detection ) :-
Some more sophisticated antivirus software uses heuristic analysis to identify new malware.
As described above, file analysis is the process by which antivirus software will analyze the instructions of a program. Based on the instructions, the software can determine whether or not the program is malicious. For example, if the file contains instructions to delete important system files, the file might be flagged as a virus. While this method is useful for identifying new viruses and variants, it can trigger many false alarms.
The second heuristic approach is file emulation. By the this approach, the target file is run in a virtual system environment, separate from the real system environment. The antivirus software would then log what actions the file takes in the virtual environment. If the actions are found to be damaging, the file will be marked a virus. But again, this method can trigger false alarms.
Protocol based analysis engine provides a framework for sophisticated inspection and analysis capabilities that, unlike hardware-based engines, can be dynamically updated to reflect changes and enhancements to network protocols as easily as a signature update.
Hope you like my post How Antivirus Software Works, Please Share with others.