Definition
Heuristic detection is a cybersecurity technique that identifies malicious software by analyzing its behavior rather than relying on known signatures. It works by establishing baseline patterns of normal system activity and flagging deviations that suggest potential threats, such as unusual file access or network communication. This approach is crucial for detecting novel or zero-day malware that has not yet been cataloged. For example, a heuristic engine might flag a program attempting to encrypt all user files as ransomware, even if its specific code is unknown. Unlike signature-based detection, which requires a known threat profile, heuristic detection offers proactive defense against emerging dangers. This concept is vital for security professionals and appears on certifications like CompTIA Security+ and CySA+.