Which detection approach is least effective against new, unseen malware?

Which detection approach is least effective against new, unseen malware?

• A. Behavioral-based detection
• B. Signature-based
• C. Heuristic analysis
• D. Sandbox testing

Answer: (B)

This question is about how different malware detection approaches handle new, unseen threats. Signature-based detection relies on a database of known malware signatures—specific patterns in code or binaries that have been identified previously. When a new malware sample appears, it typically has no matching signature yet, so it can go undetected. That makes signature-based methods much less effective against zero-day or newly released malware. In contrast, behavior-based detection looks for unusual or malicious activities regardless of the specific file, such as unexpected network activity, abnormal file system changes, or privilege escalation. This allows it to catch new malware that behaves maliciously even if its exact code hasn’t been seen before. Heuristic analysis uses rules and patterns to identify suspicious characteristics in code that may indicate malware, even if the sample isn’t in a signature database. This helps flag new or modified threats that don’t have known signatures. Sandbox testing runs software in an isolated environment and observes what it does. If the program exhibits harmful behavior, it can be detected without needing a prior signature, making it effective against unseen malware. Because it depends on known signatures, signature-based detection is the least effective approach for identifying new, unseen malware.

This question is about how different malware detection approaches handle new, unseen threats. Signature-based detection relies on a database of known malware signatures—specific patterns in code or binaries that have been identified previously. When a new malware sample appears, it typically has no matching signature yet, so it can go undetected. That makes signature-based methods much less effective against zero-day or newly released malware.

In contrast, behavior-based detection looks for unusual or malicious activities regardless of the specific file, such as unexpected network activity, abnormal file system changes, or privilege escalation. This allows it to catch new malware that behaves maliciously even if its exact code hasn’t been seen before.

Heuristic analysis uses rules and patterns to identify suspicious characteristics in code that may indicate malware, even if the sample isn’t in a signature database. This helps flag new or modified threats that don’t have known signatures.

Sandbox testing runs software in an isolated environment and observes what it does. If the program exhibits harmful behavior, it can be detected without needing a prior signature, making it effective against unseen malware.

Because it depends on known signatures, signature-based detection is the least effective approach for identifying new, unseen malware.