Guide
How antivirus detection works
Every mainstream anti-malware product uses the same four techniques. Knowing what each one is good at explains most of what you will read in a test report, and most of why no product catches everything.
1. Signature matching
The oldest technique, and still the cheapest. The engine computes a hash of a file, or looks for characteristic byte sequences inside it, and checks that against a catalogue of samples the vendor already knows to be malicious.
Strength: exact, fast, and it essentially never produces a false alarm.
Weakness: it recognises only what has already been catalogued. Recompiling or repacking a sample changes its
hash, which is why malware families produce thousands of variants. Signature coverage alone has not been sufficient
for well over a decade.
2. Static heuristics
Here the engine examines the structure of a file without running it. Is the executable packed or encrypted? Does it import functions typical of keyloggers or process injection? Are its strings obfuscated? Does the digital signature match the claimed publisher?
Strength: it generalises — one well-written rule covers a whole family, including variants nobody
has seen.
Weakness: false positives. Legitimate software does unusual things too. Installers, anti-cheat drivers,
system utilities and code written by small developers are the usual casualties, which is why the laboratories score
false positives as seriously as they score detection.
3. Behavioural monitoring
Instead of asking what a file looks like, this asks what a program does once it is running. Enumerating and encrypting documents across the whole user profile. Writing itself into the startup sequence. Injecting code into another process. Deleting the operating system’s shadow copies so that files cannot be rolled back. Each of these is rare in ordinary software and common in malware, and a sequence of them is close to conclusive.
Strength: this is the layer that stops ransomware that has never been seen before, and it is where
products genuinely differ in real-world tests.
Weakness: it acts after execution has begun. Good implementations pair it with rollback of the changes a
blocked process already made; weaker ones stop the process and leave you to clean up.
4. Cloud reputation
Before allowing an unfamiliar executable, the product asks the vendor’s servers what is known about that exact file: how many machines have reported it, over what period, whether it is signed and by whom. A binary first seen forty minutes ago on three computers worldwide is treated very differently from one that has been present on ten million machines for four years.
Strength: fast, and effective against targeted or low-volume samples that will never merit a signature.
Weakness: it requires a connection, and it means a continuous conversation between your machine and the
vendor about what is on it. That is a legitimate reason to read a security product’s privacy policy carefully
— it is the software on your system with the broadest view of your files.
What this means when you read a test report
- A file-detection test mostly exercises layers one and two. A real-world protection test, which runs live malicious URLs against the complete product, exercises all four. The second is far more informative.
- A false-positive score is not a footnote. A product that blocks your own software is not protecting you.
- A performance score matters because all four layers cost processor time and disk operations.
- Detection rates in the high nineties are normal for reputable products. The distance between that and one hundred per cent is the reason backups and multi-factor authentication still matter.
Sources
- AV-Comparatives — real-world protection, performance and false-positive test methodology.
- AV-TEST — protection, performance and usability scoring.
- SE Labs — published testing methodology.
- AMTSO — anti-malware testing standards.
- Microsoft Defender Antivirus documentation.
Diagram drawn for slovaris.online as an original SVG. Written by Ava Johnson. Corrections to info@slovaris.online.