How does antivirus software detect malware?

What is malware detection?

Malware detection is the process of identifying malicious software — viruses, trojans, ransomware✕Ransomware is malware that encrypts your files and demands a ransom to release them. An up-to-date backup is the best protection against it.More in the glossary →, spyware✕Spyware is malware that secretly gathers information about you — such as keystrokes, passwords, or browsing habits — and sends it to third parties.More in the glossary → — before or while it runs on your device. The scale of the problem is why the technology keeps evolving: the independent AV-TEST Institute registers over 450,000 new malicious programs every day. A scanner that only recognizes yesterday’s threats starts losing the moment it is installed.

That is also why the US standards body NIST warns in its malware handling guide that purely signature-based controls cannot keep up with attackers who generate unique variants for each victim. Layered detection is not marketing — it is the documented answer to how malware is actually distributed.

Signature-based detection: the classic layer

A signature is a fingerprint of a known malicious file — a characteristic byte pattern or hash. When you open or download a file, the scanner compares it against millions of these fingerprints. A match means an instant, near-certain verdict.

Signatures are fast, precise and cheap on system resources. Their weakness is just as clear: they only catch what has already been identified, dissected and added to the database. Polymorphic malware — code that rewrites itself with every copy — is designed specifically to break this fingerprinting.

Heuristic analysis: judging the suspicious

Heuristics examine a file’s structure and instructions for traits that malware tends to have — code that hides itself, unpacks more code in memory, or hooks into system processes. Instead of asking “have I seen exactly this file before?”, the scanner asks “does this file look like trouble?”

Think of it as an experienced customs officer: they have not met this particular traveler, but certain patterns raise a flag. Heuristics catch modified and repackaged variants of known families — at the price of occasional false positives, where a harmless program looks suspicious enough to get flagged.

Behavior-based detection and sandboxing

The layers above judge a file before it runs. Behavior monitoring watches what happens after: a program that suddenly starts encrypting hundreds of documents, edits system startup entries, or injects itself into other processes gets stopped mid-action, whatever its file looks like.

Some products go a step further and detonate unknown files in a sandbox first — an isolated virtual environment where the file can reveal its intentions without touching your real system. Behavior-based layers are the main defense against zero-day✕A zero-day is a security flaw still unknown to the developers — they have "zero days" of warning. Attackers can exploit it before an update exists.More in the glossary → malware, threats so new that no signature or heuristic rule exists yet.

Cloud lookups and machine learning

When your scanner meets a file it cannot classify locally, it queries the vendor’s cloud: reputation data from millions of devices plus machine-learning models trained on enormous malware collections deliver a verdict in seconds. Microsoft describes this combination of local and cloud-based ML, behavior analysis and heuristics as the core of modern next-generation protection — and the same architecture applies across reputable vendors.

The practical effect: the first victim of a new campaign may rely on behavior detection, but the millionth device to meet that file gets a cloud verdict instantly.

Why one layer is never enough

Each layer covers the gaps of the others. When you compare antivirus products, the interesting question is not whether they use these techniques — reputable ones all do — but how well the combination performs in independent lab tests.

Frequently asked questions

What is heuristic analysis in antivirus software?

Heuristic analysis inspects a file’s code and structure for suspicious characteristics — self-hiding routines, in-memory unpacking, system hooks — instead of matching exact fingerprints. It lets a scanner flag malware variants it has never seen, at the cost of occasional false positives.

Can antivirus detect zero-day malware?

Yes, but not through signatures. Zero-day threats are caught by behavior monitoring, sandboxing and cloud machine learning, which judge what a program does rather than what it looks like. Detection rates for brand-new threats are good with top products, but never perfect — which is why layered protection matters.

What is a false positive?

A false positive is a harmless file wrongly flagged as malicious, usually by heuristic or behavioral layers. Good products keep these rare; independent labs measure false alarms as part of their usability scoring. If you hit one, most scanners let you restore the file from quarantine and report it to the vendor.

Does antivirus software scan email attachments?

Yes. Real-time protection✕Real-time protection watches the system continuously and blocks threats the instant they appear, not just during a manual scan.More in the glossary → scans attachments when they are saved or opened, and many suites add a dedicated email module that checks messages as they arrive. Attachments remain one of the most common malware delivery routes, so this layer is worth having switched on.

Which antivirus gets the layers right?

Understanding the technology is half the decision. The other half is how well each product’s detection stack performs in independent testing — protection rates, false alarms and system load differ more than the marketing suggests. Our comparison breaks down how the leading antivirus software performs on exactly those criteria.