Signature vs Heuristic vs Behavioural Detection: How Malware Scanners Differ

Signature detection matches a file against known malware and is exact but blind to anything new. Heuristic detection scores suspicious structure in a file that has never been seen and trades that reach for occasional false positives. Behavioural detection runs the file and judges its actions, which is hardest to evade and most expensive. Modern scanners layer all three because each covers the others' gaps.

Three questions, three methods

The three detection methods are best understood as three different questions asked of the same file. A signature engine asks: have I seen this before? A heuristic engine asks: does this look like something I would expect malware to look like? A behavioural engine asks: what does this do when it runs? The answers are not interchangeable. A file can be brand new (signature says nothing), structurally ordinary (heuristics say nothing) and still delete your documents when opened (behaviour says everything). Equally, a file can look thoroughly suspicious to a heuristic while being a perfectly legitimate installer that a signature-based whitelist would have cleared in a millisecond.

This guide is the deep dive on the middle of the pipeline described in how antivirus scanning works. If you want to know why a scanner said what it said, this is where the answer lives.

Signature detection

What a signature is

A signature is a compact, testable description of a specific malicious file or family. The simplest is a hash: "any file whose SHA-256 is 3a7b... is Trojan X". The next step up is a byte sequence with wildcards: "any PE file containing these 24 bytes, with any 4 bytes in the middle, is Trojan X". The most capable form is logical: several sub-patterns joined by conditions on file type, size, section count or the number of times each pattern appears. ClamAV ships all three formats in its .hdb, .ndb and .ldb databases, and YARA is the lingua franca for writing them by hand. Analysts derive signatures from real samples, so the database grows with the threat landscape, and a good engine updates it several times a day.

Strengths and failure modes

Signatures are fast, deterministic and effectively never wrong. If a file matches a hash of a known malware sample, it is that sample. That is why they remain the workhorse of every product. Their failure mode is equally clean: any sample that is not in the database is invisible, and attackers know it. A malware author who recompiles with a different key, appends a byte, or runs the payload through a fresh packer defeats every hash signature and many pattern signatures. The industry's answer is to write signatures on the parts of the family that are expensive to change (the decryption routine, the command-and-control protocol, a unique string) rather than on the whole file, but it is a race, and the defenders are always slightly behind.

On Scan.now a signature match is reported as known malware signature match, and the special EICAR test signature exists so you can prove this layer works without handling real malware.

Heuristic detection

Scoring rather than matching

A heuristic is a rule about what malware tends to look like, applied to a file that may never have been seen. Instead of a yes/no match, the engine accumulates a score. Examples of rules that add weight:

• A PE file with an entry point outside its code section, or a section named by a known packer.
• A code section with near-random entropy (encrypted or compressed) and a tiny import table.
• A document that auto-runs a macro which calls Shell, CreateObject("WScript.Shell") or URLDownloadToFile.
• A PDF whose /OpenAction points at a /JavaScript object.
• A script that is mostly string concatenation, chr() calls or a base64 blob followed by an eval.
• A double extension, a mismatch between magic bytes and extension, or a Unicode right-to-left override in the name.

Above a threshold the file is flagged, usually with a generic name such as Heuristics.OLE2.ContainsMacros, Gen:Variant.* or Suspicious.Obfuscation. Structural findings on Scan.now such as Office macros, PDF JavaScript and obfuscated script are heuristics of this kind: they describe what the file contains and let you decide what that means given where it came from.

The false-positive problem

Every heuristic rule describes something a legitimate file can also do. Installers are packed. Corporate spreadsheets have macros. Minified JavaScript looks obfuscated. Software protectors deliberately produce high-entropy code. A heuristic engine tuned to catch every dropper will also flag a share of legitimate software, and a heuristic tuned never to annoy will miss the droppers. Vendors manage this with weighting, with whitelists of known-good files and signers, and by reporting heuristic verdicts with different wording so that you can tell a judgement from a match. When a scanner tells you a file is "suspicious" rather than "infected", it is telling you which layer spoke.

Behavioural detection

Watching the file act

Behavioural detection ignores what the file looks like and records what it does. In a sandbox, an instrumented virtual machine opens the file and logs process creation, file writes, registry changes, network connections, code injection and API calls. Rules then fire on sequences: a document spawning a shell, a shell downloading an executable, an executable writing to the startup folder and contacting a server on a high port. On the desktop, the same idea runs in real time through the antivirus driver, which can kill a process that starts encrypting hundreds of files in a row even if that process was clean on disk.

Evasion and cost

Because behaviour is hard to fake, attackers try to avoid producing it under observation. Sandbox-aware malware checks for virtualisation artefacts, counts CPU cores, looks for a mouse that never moves, sleeps past the analysis timeout, or waits for a real user to click. Some payloads only unlock when given a key that arrives separately, so that the file on its own does nothing. The other limit is cost: a full detonation takes minutes and a machine, which is why behavioural analysis is reserved for files that the cheaper layers could not clear, and why a quick online scan is largely static. Scan.now's file scanner is a static and structural analyser with signatures and heuristics; it does not execute your file, and it does not need to in order to see a macro, a launch action or a smuggled executable.

Side by side

Reading a detection name

Most engines encode the method in the name. A ClamAV signature looks like Platform.Category.Family-SignatureID-Revision; anything that begins with Heuristics. or PUA. came from a rule rather than a match. Microsoft Defender uses Trojan:Win32/Family.Variant!ml where the !ml suffix marks a machine-learning verdict, and Behavior: for runtime detections. Many vendors prefix generic or heuristic verdicts with Gen, Generic, Suspicious or Heur. The practical rule: a family name is strong evidence, a generic name is a reason to look harder, and the two together across several engines is close to certain.

# ClamAV verdicts, exact match vs heuristic
sample.exe: Win.Trojan.Agent-6839221-0 FOUND
invoice.docm: Heuristics.OLE2.ContainsMacros FOUND
archive.zip: Heuristics.Encrypted.Zip FOUND

Why the layers are combined, and what it means for you

The three methods fail differently, and that is what makes stacking them work. Signatures are cheap enough to run on everything, so they remove the bulk of known threats at no cost. Heuristics then examine what remains for structure that signatures were never designed to see. Behaviour catches what was engineered to look clean. Attackers who beat one layer must also beat the others, and the techniques that defeat signatures (packing, obfuscation) tend to trip heuristics, while the techniques that calm heuristics (looking ordinary) leave behaviour intact.

For someone reading a report, the takeaway is to respond to the layer. A signature hit is a fact: delete the file. A heuristic hit is a question: does the origin of this file justify its structure? A spreadsheet with a macro from your finance team is expected; the same spreadsheet from an unknown sender is not. The guide to judging a file before opening it walks through that reasoning, and malware types explained covers what the family names actually refer to.