Antivirus Systems: Detection Methods and Architectures

Antivirus systems have evolved from static pattern matchers into complex algorithmic ecosystems that encapsulate the broader logic of modern cybersecurity. This review deconstructs their internal architecture, tracing the transition from deterministic string-matching automata to probabilistic, behavioral, and cloud-assisted paradigms. Foundational modules such as scanners, heuristic analyzers, behavioral monitors, and sandbox environments operate as interconnected computational strata, forming adaptive feedback loops that mirror principles of distributed intelligence. Signature-based methods, such as Aho-Corasick, Boyer-Moore, and Wu-Manber, remain core to real-time filtering, while probabilistic reasoning through Bayesian inference, Markov modeling, and Hidden Markov Models extends detection to polymorphic and metamorphic threats. Behavioral analysis, empowered by Support Vector Machines, deep neural architectures, and temporal models, enables semantic inference over system-call graphs and runtime telemetry. Moreover, cloud-assisted frameworks integrate federated learning and global reputation graphs, which transform detection into a collective intelligence process.