Understanding Heuristics Article - Alcatraz Security
Web Resources    |    Sitemap    |    Terms of Use    |    Privacy Policy

Understanding Heuristics

Date: 2024-10-09

Wikipedia defines heuristics as "a technique designed to solve a problem that ignores whether the solution can be proven correct, but which usually produces a good solution or solves a simpler problem that contains or intersects with the solution of the more complex problem."

To help explain heuristics let's look at the way traditional antivirus programs work. They have a process that runs in real-time on your computer to check each and every file from the sources you tell it to check, such as email, media, and Internet download. What is the process looking for in the files? It's looking for anything in the files that matches the antiviruses definition files. The definition files contain a list of known virus and what the actual code of those viruses look like. It's like watching people going through a check point and checking a book of mug shots at the same time to try to identify a known felon.

Heuristics steps it up a notch. It looks at the patterns, code method, of those known viruses and it looks for similar code that might be trying to do something similar, even though it does not have a definition file to prove the code is destructive. Using our known felon analogy, it would be like reading the summary of what these felons were doing before they were arrested. Some might have been peeking through windows; some may have been lurking in dark alleyways, other wearing dark clothing at night. There is nothing illegal with any of those things, just suspicious. That's enough for heuristics to stop them right then and there before the crime is committed.

The downside of heuristics is some of those acts may have been legitimate. And the process takes slightly more resources than tradition pattern file checking. All in all, it's a great technology in the development of proactive security solutions. Armed with a security product that includes heuristics can really give you an advantage in today's onslaught of virus mutations.

Comments

No comments so far.

Post Comment

Web Resources   |   Sitemap   |   Terms of Use   |   Privacy Policy

© 2006 Alcatraz Security. All rights reserved.

Designed by Fast Internet Success