For real-time protection and virus scanning, Norton provides a multi-layered approach, including:
Malware directory.
Heuristic analysis.
Machine learning.
Heuristics analysis and machine learning are mostly used to detect zero-day threats. Heuristics compares the code of new files against known malware, flagging files with similar code. And machine learning analyzes files based on their behavior, looking for actions similar to those in malware files. With both of these approaches, if Norton detects anything suspicious, it will block and flag it.