What is the term for the database of known malware patterns used by antivirus software?

What is the term for the database of known malware patterns used by antivirus software?

• A. Virus Signatures
• B. Heuristics
• C. Sandboxes
• D. Rules

Answer: (A)

Antivirus software identifies known malware by comparing files to a database of known malicious patterns. This collection is called virus signatures. Each signature represents a specific characteristic of malware—such as a unique byte sequence inside an executable, a particular file hash, or a fingerprint of its behavior—that lets the scanner recognize that malware quickly. When a file matches a signature, the software can block, quarantine, or delete it. This method is fast and effective for threats that have already been cataloged, but it relies on having up-to-date signatures to catch the latest variants, since new or obfuscated malware may not match anything in the database yet. Heuristics, in contrast, look for suspicious behavior or code patterns to detect unknown threats; sandboxes run programs in a controlled environment to observe actions; and rules pertain to policy or configuration criteria used by security tools, not the database of known patterns.

Antivirus software identifies known malware by comparing files to a database of known malicious patterns. This collection is called virus signatures. Each signature represents a specific characteristic of malware—such as a unique byte sequence inside an executable, a particular file hash, or a fingerprint of its behavior—that lets the scanner recognize that malware quickly. When a file matches a signature, the software can block, quarantine, or delete it. This method is fast and effective for threats that have already been cataloged, but it relies on having up-to-date signatures to catch the latest variants, since new or obfuscated malware may not match anything in the database yet.

Heuristics, in contrast, look for suspicious behavior or code patterns to detect unknown threats; sandboxes run programs in a controlled environment to observe actions; and rules pertain to policy or configuration criteria used by security tools, not the database of known patterns.