Which analysis method helps detect new or unknown viruses that are typically variants of an existing virus family?

Which analysis method helps detect new or unknown viruses that are typically variants of an existing virus family?

• A. Heuristic Analysis
• B. NetFlow Traffic Analyzer
• C. DNSChanger
• D. API Monitor

Answer: (A)

Detecting new or unknown viruses that resemble an existing family is best done with heuristic analysis. This approach looks at how a program behaves and the patterns it exhibits rather than relying only on a pre-existing signature. By evaluating actions such as self-modification, persistence mechanisms, abnormal file changes, or network activity that mirrors known malware families, heuristic analysis can flag variants even when a precise signature doesn’t exist yet. It’s particularly useful for catching zero-day or slightly altered threats that traditional signature-based methods would miss. NetFlow Traffic Analyzer focuses on network traffic patterns, not on identifying malware. DNSChanger refers to a specific piece of malware that alters DNS settings, not a general detection method. API Monitor observes API calls for debugging or analysis, not for detecting unknown malicious code.

Detecting new or unknown viruses that resemble an existing family is best done with heuristic analysis. This approach looks at how a program behaves and the patterns it exhibits rather than relying only on a pre-existing signature. By evaluating actions such as self-modification, persistence mechanisms, abnormal file changes, or network activity that mirrors known malware families, heuristic analysis can flag variants even when a precise signature doesn’t exist yet. It’s particularly useful for catching zero-day or slightly altered threats that traditional signature-based methods would miss.

NetFlow Traffic Analyzer focuses on network traffic patterns, not on identifying malware. DNSChanger refers to a specific piece of malware that alters DNS settings, not a general detection method. API Monitor observes API calls for debugging or analysis, not for detecting unknown malicious code.