How Does Antivirus Work?
Antivirus is software that protects a computer or mobile device from viruses and other malware that are designed to steal personal information, hijack a system or wreak other havoc. Antivirus programs scan files, websites and external devices for signs of malicious activity. If a threat is found, the program can warn you about it, prevent you from accessing it or remove it from your system.
The vast majority of antivirus programs use a signature-based detection technique. This means they maintain and regularly update a database of malware that has been identified, a collection known as virus definitions. When a new threat appears, it’s compared against this list to see if the fingerprint matches one of the definitions. If the match is successful, the threat is flagged as dangerous and blocked from entering your system.
Modern antivirus programs also use heuristics, a method that analyzes a program’s behavior for suspicious signs that may indicate a malicious intent. For example, heuristics can identify a virus that attempts to hide itself by constantly changing its appearance, or one that monitors keystrokes and attempts to connect remotely to your system.
Another way to determine the effectiveness of an antivirus program is by checking its detection rate, which refers to the percentage of malware it detects in controlled tests. This number doesn’t tell you how well the software will protect your specific computer or mobile device, but it is a good indicator of how well the program works overall.