heuristic

monitors for behaviours of different components of the system to detect malware