How antivirus software actually detects things

Signature matching: recognising what is already known

The oldest method is also the simplest. When researchers obtain a sample of malicious software, they extract something that identifies it — historically a sequence of bytes, in practice now a cryptographic hash of the file, a pattern that survives minor changes, or a rule describing a combination of features. That identifier is a signature. The product downloads updated signatures regularly, and when a file arrives on your device, it is checked against them.

Signature matching is fast, cheap in processing terms, and close to exact. If a file matches a known signature, the product is not guessing. That precision is why the method has never been retired despite being decades old.

Its limitation is structural rather than fixable: a signature can only describe something someone has already collected and analysed. Malicious software that has been altered even slightly may produce a different hash and slip past, and much of it is generated afresh for each distribution run precisely so that this happens. The gap between a new piece of malicious code appearing and a signature for it reaching your device is the window every other method exists to cover.

Heuristic analysis: judging the unfamiliar

Heuristic analysis asks a different question. Rather than “have I seen this exact thing before?”, it asks “does this look like the kind of thing I have seen before?”

A static heuristic examines the file without running it: how it is structured, whether it has been packed or obfuscated to hide its contents, whether it imports the sorts of system functions associated with tampering, whether its stated purpose matches its size and composition. A dynamic heuristic goes further and runs the file inside an emulator or sandbox — an isolated, disposable environment — to see what it attempts before letting it near the real system.

This is where the modern generation of machine-learning classifiers sits too. A model trained on very large numbers of known-good and known-bad files learns which combinations of features predict which category, and scores new files accordingly. The mechanism is newer; the logic is the same as any heuristic, and so is the weakness.

That weakness is that a judgement about the unfamiliar is a probability, not a fact. Push the sensitivity up and the product starts flagging legitimate software that happens to share characteristics with malicious code — installers, system utilities, anything that modifies other programs, and a good deal of specialist or in-house software. Push it down and genuinely malicious files pass.

Behavioural monitoring: watching what programs do

The third method waits until code is running and observes it. It is indifferent to what a file looks like and interested only in what it does.

Certain sequences of actions are difficult to explain innocently. A program that begins opening large numbers of documents, encrypting them and deleting the originals is behaving like ransomware regardless of what it is called or how it was written. A program that reads keystrokes while the user is signing in to a bank, or that quietly attaches itself to the list of things that start when the computer boots, is doing something a word processor never needs to do.

Behavioural monitoring is the method most likely to stop something genuinely new, because novel malicious software still has to do recognisable work to achieve anything. Some products pair it with rollback, keeping shadow copies of files so that changes made by a process later judged malicious can be reversed.

Its cost is that detection happens during the act. The protective question is how quickly the product intervenes and how much it can undo, and a small amount of damage before the intervention is normal rather than exceptional.

Reputation and cloud lookups

Layered over all three is reputation. Instead of deciding alone, the product asks a vendor service what is known about this file: how many other installations have seen it, how long it has existed, whether it carries a valid digital signature from a known publisher, whether it is arriving from a domain associated with distribution of malicious software.

A file that millions of machines have run for years without incident is treated differently from one first seen four minutes ago on a handful of devices. This is efficient and it shortens the response time to new threats considerably, because the vendor can change a verdict centrally rather than waiting for an update to reach every device.

It has two implications worth being aware of. It requires an internet connection to work fully, so protection can be weaker offline. And it means the product is sending information about the files on your device to the vendor. What is sent — names, hashes, whole files — varies by product and setting, and is described in the vendor’s own privacy documentation rather than anywhere else. If that matters to you, it is worth reading before installing, not after.

The trade-off nobody escapes

Every detection method sits on a single dial. At one end, the product is cautious and quiet: few interruptions, few false alarms, and more malicious files getting through. At the other, it is aggressive: more catches, and more legitimate software blocked, quarantined or deleted without warning.

There is no setting that eliminates both kinds of error, and any marketing that implies otherwise is describing something that does not exist. Vendors choose a position on that dial, and reasonable vendors choose differently for home users than for enterprises.

False positive

Legitimate software incorrectly identified as malicious. Costly when the file is something you need, or part of the operating system.

False negative

Malicious software incorrectly treated as safe. The failure the product exists to prevent.

Quarantine

A holding area where a suspect file is stored, inert, rather than deleted — so that a mistaken verdict can be reversed.

Zero-day

A flaw, or a piece of malicious software, for which no fix or signature yet exists because it has only just become known.

Sandbox

An isolated environment in which unknown code can be executed and observed without reaching the real system.

What this means in practice

• Detection rate figures are only meaningful with a false-positive rate beside them. A product that flags everything scores perfectly on one measure and is unusable.
• Updates matter more than the product badge. Signature and model updates are the mechanism; a lapsed licence stops them.
• If something you trust is quarantined, check the quarantine before reinstalling. The file is usually recoverable, and reporting the mistake to the vendor is how the classifier improves.
• Running two real-time scanners at once tends to cause conflicts rather than double the protection, because each treats the other’s file access as suspicious.
• No detection method addresses a person being persuaded to install something themselves. That is a different problem with a different remedy.

For platform-neutral guidance on keeping devices current, the Australian Cyber Security Centre publishes advice for individuals and small business, including on updates and device configuration.