Heuristic Scanning

What is Heuristic Scanning?

Heuristic Scanning is a antivirus technology method to detect new, unknown viruses or Malware that not yet been identified or in the database of antivirus. Only some antiviruses can do this type of scan, the majority are only able to detect  known viruses.

It based on examination of a virus and look on the sequence or sequences of instruction that differentiate the virus from normal programs

Pros and cons of heuristic analysis 

The advantage of heuristic scan is it able to detect unknown viruses based on the previous virus that have common characteristic and shared by the different virus. However, it have to use a lot of time and processing resource of computer to scan the file/virus, it also easily increase the number of false positives software.

The information provided by the heuristic scan is not 100% , this is because the data generated uses a complex and sophisticated methods which normally hard to interpret, so if you found that the suspicious file have detected by your anti-virus. You should sent it to the antivirus laboratory for analysis and study deeply for the virus/ suspicious file that detected by your anti-virus.

Heuristic Scan methods

Anti-Virus software use more that 1 techniques to detect malware. However, there are main essence of each method s to analyze the file characteristic and behavior to determine whether it was a malware.Therefore, Heuristic scan also can be know as behaviour scanning, which below is the technique:

First is File Emulation (SandBox) which is file emulation to allow the file to run in a virtual sytem which known as sandbox where you can perform testing of the file without effect the host computer.

Another method is using file analysis, which is the method to scanning the file and if the file acts like a virus , the antivirus will deemed a virus.

The third method is know as Generic Signature Detection, which designed specifically  to locate the variations of viruses . There are many virus recreated and change the name of the virus but essentially come from the same classification. So the Antivirus will use the previous definitions to locate the similar virus even they use different names and slightly different fingerprints but at the end the DNA is identical.