Antivirus software uses multiple methods for malware identification. Signature-based detection relies on a Virus Definition File (VDF) containing known virus signatures that must be updated regularly. An outdated VDF is ineffective against new malware, and this method fails to detect polymorphic or encrypted malware.

Sandbox detection executes new applications in a virtual environment to observe their behavioral fingerprint. Though slow, it is safe as it prevents access to actual system resources. Heuristics compares the source code of suspected programs to known viruses in a heuristic database, flagging potential threats based on code similarity.

Real-time protection monitors applications in the background for suspicious activity during execution. Additionally, Data mining techniques use machine learning to classify file behavior as benign or malicious.