Signature matching
A signature is a fingerprint of a known malicious file, often a hash such as SHA-256. If an app matches a fingerprint in the database, it is flagged. This is fast and accurate for known malware, but it cannot spot something brand new.
Behavioural (heuristic) analysis
This looks at what an app asks for or does: unusual permission combinations, an untrusted install source, or actions that look like spyware. It can catch unknown threats but can produce false alarms.
Why both are used
Signatures give precision, and behaviour analysis gives coverage. Together they reduce both missed threats and false alarms.
In Psylinks AV
The beta app uses SHA-256 signature matching against known malware databases and a behavioural risk engine that flags risky permission combinations and untrusted sources. New apps are checked when they are installed. See the product page.
Frequently asked questions
What is a false positive?
When a safe app is wrongly flagged as risky. Behaviour-based detection is more prone to this.
Can signatures detect zero-day malware?
No. By definition they only match known samples.