Glossary

Antivirus and device security terms, defined

Around forty terms that appear on security product pages, in support articles and in news coverage. Each entry gives the meaning first, then the distinction people most often get wrong.

Terms are grouped alphabetically. Where two entries are easily confused, each one points at the other, because the confusion is usually the thing worth fixing. Entries describe the concept generally; they do not describe how any particular product implements it. Where a phrase is a marketing coinage rather than a defined technical term, the entry says so rather than inventing a precision the industry has never agreed on.

A

Adware

Software that displays advertising, redirects searches or injects advertisements into pages, usually installed alongside something the user did want. It is generally classed as a potentially unwanted program rather than as malware, because it is a nuisance rather than an attack.

Allowlist (exclusion)

A list of files, folders or processes a scanner is told to ignore. Useful when a scanner repeatedly produces a false positive on something you know to be safe, and dangerous when used to silence a warning you have not understood. Older documentation calls this a whitelist.

Attack surface

The total set of points where something could be attacked: installed software, open network services, browser extensions, accounts with access. Reducing it — removing software you no longer use, closing accounts — is unglamorous and more effective than most product features.

Automatic renewal

A subscription arrangement where the vendor charges again at the end of each term unless it is cancelled first. Nearly universal in this category. The price after the first term is frequently not the price of the first term, and the two are set out in different places. See licences and subscriptions.

B

Backup

A copy of your data held separately from the original. The widely cited rule of thumb is three copies, on two kinds of media, with one kept off-site. A current backup is the only reliable answer to ransomware, which is why it matters more than any detection feature.

Behavioural analysis

Watching what a program does once running — which files it opens, what it writes, where it connects — and intervening when the pattern matches known malicious behaviour. Distinct from heuristic detection, which examines a file before it runs. Behavioural analysis can catch something a scanner missed, but only once it has begun acting.

Botnet

A collection of compromised devices controlled remotely and used together, typically to send spam, mine cryptocurrency or generate traffic against a target. An infected device in a botnet often shows no symptom its owner would notice.

C

Cloud lookup

Sending a hash or metadata about a file to the vendor's servers to ask whether it is already known. Faster to update than a downloaded definition file, and it means the product's judgement of a file can change without any update being installed. It also means the product sends information about your files to the vendor; the vendor's privacy policy says what.

Command and control

The server infrastructure an attacker uses to issue instructions to compromised machines. Often abbreviated C2. Blocking connections to known command and control addresses is one of the things a firewall or a network filter can do that a file scanner cannot.

D

Definition update

The regular download that adds new signatures to a scanner. Separate from a program update, which changes the software itself. A product with current definitions and an outdated program is a common and easily missed state.

Drive-by download

Malicious code delivered by visiting a page, without the visitor agreeing to any download, by exploiting a flaw in the browser or a plugin. A patched browser removes most of this category, which is why patching is listed ahead of scanning in most official guidance.

E

Endpoint

Any device that connects to a network and is used by a person: laptop, phone, tablet, desktop. Business security products are usually sold as endpoint protection, which is the same idea as consumer antivirus with central management added.

Exploit

Code that takes advantage of a specific vulnerability to make software do something it should not. An exploit is the technique; the payload it delivers is a separate thing, and the same exploit can carry different payloads.

F

False positive

A clean file reported as malicious. Unavoidable in any system that tries to identify things it has not seen before, and genuinely costly: a false positive on a system file can stop a machine booting, and a stream of them teaches people to dismiss warnings. This is why detection rates quoted without a corresponding false positive rate say very little.

False negative

Malicious code the product failed to detect. The complementary error to a false positive, and in constant tension with it: tuning a scanner to catch more of one produces more of the other.

Firewall

A filter on network traffic, deciding what may enter or leave a device or network by rule. It governs connections, not file contents, so it is complementary to a scanner rather than a substitute. Windows, macOS and most home routers include one.

Full scan

An inspection of every file on a device, as opposed to a quick scan of the locations malicious code usually occupies, or real-time protection that inspects files as they are used. Slow, and mostly useful for confirming a suspicion rather than for routine prevention.

H

Hash

A short fixed-length value calculated from a file's contents, which changes completely if a single byte of the file changes. Hashes let two systems compare files without exchanging them, and they are what most signature matching and cloud lookup actually compares.

Heuristic detection

Judging a file by its characteristics — structure, instructions, packing, similarity to known families — rather than by matching it against a list of known samples. This is what allows a scanner to flag a variant it has never seen. It is also the main source of false positives, and vendors tune its aggressiveness differently.

K

Keylogger

Software that records keystrokes, usually to capture passwords and card numbers. A category of spyware defined by what it collects rather than by how it arrives.

M

Malware

The umbrella term for software written to do something harmful: viruses, worms, trojans, ransomware, spyware and more. The categories overlap, because they describe different things — some describe how it spreads, others what it does. See malware types explained.

Multi-factor authentication

Requiring more than one kind of proof to sign in: something you know, plus something you have or something you are. It protects accounts rather than devices, so no antivirus product substitutes for it. The ACSC publishes guidance on setting it up.

O

On-access scanning

Inspection triggered by a file being opened, saved or executed. The technical name for what product pages call real-time protection.

P

Password manager

An application that generates and stores distinct passwords for each account behind one master credential. Frequently bundled into security suites. It addresses password reuse, which is a different risk from the one a scanner addresses.

Patch

An update that fixes a vulnerability in software. Applying patches promptly removes the flaws that exploits depend on, and appears at or near the top of most government guidance on protecting a device.

Phishing

A message engineered to make someone reveal a credential or make a payment, usually by imitating an organisation they trust. It targets the person rather than the machine, so it is countered by habits and by account protections more than by software. Current examples are published by Scamwatch.

Potentially unwanted program

Software that is not malicious but that most people would not install deliberately: toolbars, bundled utilities, aggressive adware. Whether a given program counts is a judgement, and vendors draw the line in different places, which is why one product flags something another ignores.

Q

Quarantine

A holding area where a scanner puts a suspect file: encoded so it cannot run, but not deleted, so it can be restored if the detection turns out to be a false positive. Checking quarantine before emptying it is worth the minute it takes, particularly after a detection on a document or a work file.

R

Ransomware

Malicious software that encrypts files and demands payment for the key, often threatening to publish the data as well. The defence that works is a current, disconnected backup. The ACSC publishes specific guidance on ransomware, including why paying is discouraged.

Real-time protection

Continuous inspection of files as they are opened, written or executed, rather than only during a scheduled scan. The marketing name for on-access scanning. Present in essentially every current product, including the protection built into Windows and the platform controls on mobile operating systems, so its presence alone distinguishes very little.

Rootkit

Software that hides its own presence by interfering with the operating system's reporting, so that files or processes do not appear in ordinary listings. Detecting one from within a compromised system is inherently unreliable, which is why rescue media that boots separately exists.

S

Sandbox

An isolated environment where a suspect file can be run and observed without touching the real system. Used by vendors to analyse samples, and in a lighter form by browsers and mobile operating systems to limit what any one application can reach.

Scareware

Software or web pages that claim a device is infected in order to sell something or to install something worse. The tell is the claim itself: a web page cannot scan your device, and a genuine security product does not advertise by pop-up. Report examples to Scamwatch.

Seat

One device covered by a licence. A subscription described as covering five devices provides five seats, and the count is usually enforced by the vendor's account system rather than by the software. Check it against the number of phones, tablets and computers actually in the household before buying.

Signature

A stored pattern — often a hash or a distinctive sequence of bytes — that identifies one known piece of malicious code. Exact and cheap to check, and by definition effective only against samples already analysed. Everything else in a scanner exists because signatures cannot cover the unknown.

Social engineering

Manipulating a person into granting access or making a payment, rather than defeating a technical control. Phishing is one form. Software can filter some of the messages; it cannot make the decision for the person reading them.

Spyware

Software that collects information about a person's activity without meaningful consent — keystrokes, browsing, location, messages. Defined by purpose rather than by how it gets onto a device, so a trojan may carry it.

T

Trojan

Malicious code disguised as something wanted, relying on the user to install it. Unlike a virus or a worm, it does not spread by itself. The category describes how it arrives, not what it does once there.

V

Virus

Malicious code that attaches itself to another file or program and spreads when that host is run or copied. Now a small part of the landscape, though the word is still used loosely for all malware — including in the name of the software category itself.

Virtual private network

An encrypted tunnel between a device and a server run by the VPN provider, so that traffic leaves from that server's address rather than the device's. It changes who can observe the connection — the provider replaces the local network — and does nothing about malicious files, so it solves a different problem from an antivirus product despite being bundled with them.

Vulnerability

A flaw in software that can be misused to make it behave in an unintended way. A vulnerability with no available fix is a zero-day; once a patch exists it is no longer one, whatever advertising copy suggests.

W

Worm

Malicious code that spreads across a network by itself, without needing a host file or any user action. The distinction from a virus is self-propagation, and it is why worms historically spread far faster than anything requiring a person to click.

Z

Zero-day

A vulnerability for which no fix has been released — the vendor has had zero days to address it. Precise as a technical term, and used loosely in advertising to mean any recent threat. Protection against an unpatched flaw comes from behavioural and heuristic methods, not from signatures.

Using these definitions on a product page

The practical use of a glossary is subtraction. Reading a feature list with these entries in mind, a good many items turn out to describe the same mechanism under different names, and several describe something the device already does. What remains is usually a short list: how many seats the licence covers, what the term costs after renewal, what the product sends to the vendor, and which of the bundled extras — a VPN, a password manager, a backup allowance — you would otherwise pay for separately.

The detection page follows those mechanisms through a single file from download to verdict, which is the clearest way to see how they fit together. For the terms specific to buying rather than to technology, licences and subscriptions covers seats, terms and renewal in the Australian context.