As computer viruses have become increasingly problematic, methods of detection have evolved to combat them. There are several different methods that antivirus programs employ to identify viruses, malware and other computer threats. These methods include: Signature-based detection: Traditional antivirus software relies heavily on signature-based detection to identify viruses and malware. In this method, each time a new malware variant is discovered and arrives in the hands of an antivirus company, a signature of the file is extracted and added to the signatures database of the antivirus software. This approach has its limitations, as threat actors have tried to outsmart signature-based antivirus software by creating advanced viruses which modify themselves as a method of disguise to avoid matching existing virus signatures. Heuristics: Heuristic analysis is a popular and effective method for detecting previously unknown viruses, as well as new variants of viruses already in the wild by examining code for suspicious properties. This technique determines the susceptibility of a system to a particular threat using various weighing methods or decision rules. Heuristics analysis is one of the few methods capable of identifying polymorphic viruses. Real-time protection: Real-time protection refers to the automatic protection provided by many antivirus and anti-malware programs, which monitors systems for suspicious activity. Sandbox detection: This behavior-based detection technique runs programs in a virtual environment, logging programs’ actions and behaviors. Depending on the actions logged, antivirus engines that utilize this technique can determine whether a program is malicious or not. This technique has proven to be highly effective, but is rarely used in end-user antivirus solutions due to its slowness. Data mining techniques: In this relatively new approach to virus and malware detection, data mining and machine learning algorithms are used to classify the behavior of a file and determine whether it is malicious or benign depending on a series of features that are extracted from the file.