Antivirus protection
In an online environment of rapidly changing and adapting threats from malicious programs, antivirus programs must rely on varied and sophisticated strategies to anticipate the attacks of cyber criminals and keep up the cause of virus protection. One of the most valuable, flexible antivirus tools relies on a kind of detection known as heuristic analysis. This technique possesses the capacity for detecting unusually subtle and thereby dangerous malware.
Heuristic analysis was imported to the field of virus protection from the general toolbox of techniques formulated for problem-solving. This form of engagement with potential dilemmas prioritizes experience and the intuitive sense that is derived from it. In English, a close vernacular equivalent for heuristic is the phrase “rule of thumb,” something not claimed to be true invariably but holding true in enough case as to be a useful tool for rapid-decision making and action undertaken without the luxury of extended study. Like many other fields, virus protection can practicably and frequently put this mode of thinking to practice.
A major problem for software developers and online security experts in formulating antivirus products and strategies is the existence of “Zero day” threats,” flaws in the construction of software that come to the attention of online attackers before the developers. Attacks exploiting such weaknesses, taking place on “day zero” before the creator’s recognition of the problem, can be particularly damaging to items of software and their users and owners. Since this virus protection problem is rooted specifically in the lack of knowledge, the heuristic approach to problem-solving has been drawn on by antivirus professionals in formulating their response. The criterion of a heuristic is probable success, not proven effectiveness, which saves the time and effort of trying to gather verifiable information on inherently unforeseeable virus protection issues. Heuristic-based algorithms for antivirus software can thus anticipate attacks in a manner similar to that of human intuition. This results-oriented approach to virus protection appeals to the companies financially threatened by Zero day issues.
The mutation of viruses, as exemplified by Zero day-based attacks, prevents challenges to more conventional antivirus programs.
A specific application of heuristic thinking to virus protection is based in identifiers for programs known as generic signatures. Such programs are designed to run conventional antivirus procedures searching for known and recognizable malware, as well as programs that slightly vary from it in their coding. They can also predict future attacks mounted by as yet unknown viruses by running a simulation of a file and observing its capacity to inflict damage on operating systems.
The widespread nature of antivirus software ensures that the margin of error in heuristic software can sometimes exceed acceptable levels. The useful performance of this form of virus protection depends on it maintaining a balance between false positives and false negatives in making antivirus judgments. A Symantec virus protection program, in one instance, removed essential components from thousands of operating systems after misdiagnosing them as being infected. Though an effective technique, heuristic programs must be utilized carefully.
