security//behavioral detection

Behavioral detection is a security detection approach that judges whether a process, identity or sequence of actions behaves suspiciously, rather than whether a file exactly matches a known malicious artifact, and it is used against novel and generated attacks that match no known file. Signature-based antivirus recognizes known artifacts; behavior can recognize a familiar attack pattern carried by a new one.

Behavioral detection is a security detection approach that judges whether a process, identity or sequence of actions behaves suspiciously, rather than whether a file exactly matches a known malicious artifact, and it is used against novel and generated attacks that match no known file. Signature-based antivirus recognizes known artifacts; behavior can recognize a familiar attack pattern carried by a new one.

The same choice makes calibration difficult. Administrators, automation and AI agents routinely perform unusual actions for legitimate reasons. Strong detection therefore combines context, sequence, baselines and consequence instead of treating rarity as a synonym for hostility.

Novelty is evidence. It is not a verdict.