System Watcher: Heuristic Analyzer - Kaspersky Lab

Kaspersky PURE 2.0
System Watcher. Heuristic Analysis
Using patterns of dangerous behavior (BSS)
Patterns of dangerous activity (BSS – Behavior Stream Signatures) contain sequences of
actions typical of applications classified as dangerous. In addition to exact matching between
applications' activities and patterns of dangerous activity, System Watcher also detects
actions that partly match patterns of dangerous activity, being considered suspicious based on
the heuristic analysis. If suspicious activity is detected, System Watcher prompts the user for
action regardless of the operation mode.
Upon detection of a new virus or new modification of already known malware the application
does not update the entire System Watcher component, but simply adds a new template to
the database of heuristics and updates it together with the Kaspersky Lab databases.
To select the action that the component should perform if an application's activity matches a
pattern of dangerous activity, perform the following actions:
1. Open the application settings window.
2. In the left part of the window under Protection select System Watcher.
3. In the right part of the component settings in the Heuristic Analysis section check the
Use behavior stream signatures (BSS) box.
4. In the On detecting malware activity section perform the following actions:
► Select the Select action automatically variant (if the automatic protection mode is
enabled). In this case System Watcher will automatically apply an action
recommended by Kaspersky Lab specialists.
► Select the Prompt for action variant (if the interactive protection mode is enabled).
In this case System Watcher will notify you of any suspicious activity detected in the
system and will prompt for action: allow or block activity.
► Choose the Select action variant:
► Move file to Quarantine (malicious application will be moved to Quarantine).
► Terminate the malicious application (all processes of the malicious application
will be terminated).
► Ignore (System Watcher takes no actions on the application).
1 | 2