- Get link
- X
- Other Apps
This is what it does: What Signature-based scanning technologies are usually supplemented by heuristic tools. This scanning method detects a threat based on patterns in the file. In this way, the AV tool can also detect new malware that is not yet in the signature database.
Behavior
analysis
This is what it does: Since signature-based scans (virus
must be known) and heuristic scans (virus must correspond to a known pattern)
do not detect completely new viruses, AV manufacturers have developed
behavior-based detection, which is also known as behavioral blocking. A scanner
observes the behavior of a program. For example, if an EXE file has no program
window, but tries to intercept keystrokes and establish an Internet connection,
this is suspicious. It could be a keylogger spying on all of your input. The
trick now is not to suspect harmless files. In the example given, it can be a
keylogger, but it can also be a new keyboard driver.
You should pay attention to this: In order to prevent false
alarms, behavior analysis is often combined with the technique of -
›reputation-based recognition.
Reputation-based
detection
EnlargeThis window will be displayed during the installation
of Kaspersky Internet Security. You agree that information on suspicious files
on your computer may be downloaded to Kaspersky on the Internet.
What it does: With reputation-based recognition, a new
program takes a digital fingerprint - in the simplest case this is a hash value
- and compares it with a database at the manufacturer. Is the file already
known to be harmless or dangerous? Is it the first time or have many other PCs
reported this program? The antivirus program works together with the -
›behavior analysis, which has logged, for example, where the file came from. If
it was downloaded from a server in China, for example, this can reduce the
reputation of the file if viruses have already been distributed from this
server.
You should pay attention to this: Reputation-based detection
almost always requires contact with the Internet in order to obtain current
information about the suspicious file from there. However, it also sends
information from your computer to the Internet, for example about the
suspicious file. The manufacturers name this technology differently. At
Kaspersky it is called “Kaspersky Security Network”. You have to agree to the
use of this technology during the installation, as it sends data from your PC
to the Internet. If you object to its use, no data will flow into the internet.
But you also do without an important protective layer of the antivirus program.
Computer on the Internet, for example to the suspicious file. The manufacturers
name this technology differently. at
In addition: The protection techniques behavior analysis,
reputation and community protection as well as cloud technology and AI
protection are often combined by the manufacturers and appear in some antivirus
tools under a single point. The scanner or scanners sometimes have imaginative
names such as at F-Secure , where the scanner is called "Deep Guard".
In the current version of Kaspersky , these functions are simply summarized in
the settings under the item "Heuristics".
READ MORE:-