Which concept analyzes behavior to identify suspicious activities?

• A. Heuristics
• B. Email Antivirus
• C. Web Browsing Antivirus
• D. Threats to Detect

Answer: (A)

Analyzing behavior to identify suspicious activities is done with heuristics. Heuristics uses rules and general patterns to assess how a program or process behaves—things like unusual file access, unexpected network connections, or odd privilege changes—and flags actions that look suspicious even if the item isn’t known malware. This behavior-first approach helps catch new or unknown threats that don’t yet have a signature. In contrast, email antivirus focuses on scanning email content and attachments for known malware signatures, and web browsing antivirus checks pages and downloads for known bad patterns in web traffic. “Threats to Detect” isn’t a detection method, so it doesn’t describe how behavior is analyzed.