Heuristic analysis is a security detection method that looks for suspicious characteristics or behavior rather than relying only on signatures of previously identified threats. For example, security software may flag a program that rapidly encrypts many files or makes unusual changes to system settings, even if the program is new or has been modified to evade known signatures.
This approach can help detect previously unseen malware, including ransomware, but may also produce false positives when legitimate software behaves unusually. Defenders commonly combine heuristic analysis with signature-based detection and other controls, then investigate alerts to determine whether activity is malicious.