User Guide - Kaspersky Lab

90 Kaspersky Internet Security 7.0
Figure 22. Creating an application list
7.2.4. Using Heuristic Analysis
Heuristic methods are utilized by several real-time protection components, such
as File, Mail, Web Anti-Virus, as well as virus scan tasks.
Of course, scanning using the signature method with a database created
previously containing a description of known threats and methods for treating
them will give you a definite answer regarding whether a scanned object is
malicious and what dangerous program class it is classified as. The heuristic
method, unlike the signature method, is aimed at detecting typical behavior of
operations rather than malicious code signatures that allow the program to make
a conclusion on a file with a certain likelihood. The advantage of the heuristic
method is that it does not require prepopulated databases to function. Because
of this, new threats are detected before virus analysts have encountered them.
• In the event of a potential threat, the heuristic analyzer emulates object
execution in the Kaspersky Internet Security secure virtual environment. If
suspicious activity is discovered as the object executes, the object will be
deemed malicious and will not be allowed to run on the host or a
message will be displayed requesting further instructions from the user:
• Quarantine the new threat to be scanned and processed later using
updated databases
• Delete the object
• Skip (if you are positive that the object cannot be malicious).