Which term describes a detection method that uses feature comparisons and likenesses rather than signature matching to identify malicious activity?

Which term describes a detection method that uses feature comparisons and likenesses rather than signature matching to identify malicious activity?

• A. Web filtering
• B. Configuration baselines
• C. Heuristics
• D. Trend analysis

Answer: (C)

This question tests the idea of detecting threats by comparing features and likenesses rather than matching exact signatures. Heuristics evaluate a range of attributes and behaviors to judge how closely something resembles known malware or attack patterns. By looking at characteristics such as unusual file activity, suspicious system calls, or specific behavioral traits, a heuristic detector assigns a risk level and can flag new or mutated threats that don’t have a known signature yet. This approach is different from signature-based detection, which relies on exact byte-for-byte matches to a database of known malicious files. Others rely on blocking or comparing against standards or trends rather than likeness-based feature analysis. Web filtering focuses on URLs and content categories, configuration baselines compare current settings to a predefined good state, and trend analysis examines historical data to spot deviations. The feature-based likeness approach described here is what makes heuristics the best fit.

This question tests the idea of detecting threats by comparing features and likenesses rather than matching exact signatures. Heuristics evaluate a range of attributes and behaviors to judge how closely something resembles known malware or attack patterns. By looking at characteristics such as unusual file activity, suspicious system calls, or specific behavioral traits, a heuristic detector assigns a risk level and can flag new or mutated threats that don’t have a known signature yet. This approach is different from signature-based detection, which relies on exact byte-for-byte matches to a database of known malicious files.

Others rely on blocking or comparing against standards or trends rather than likeness-based feature analysis. Web filtering focuses on URLs and content categories, configuration baselines compare current settings to a predefined good state, and trend analysis examines historical data to spot deviations. The feature-based likeness approach described here is what makes heuristics the best fit.