Limitations of the Signature-Based Anti-Malware

ONLY malware with known signatures can be detected, NOT the unknown variants

Most of today’s anti-malware solutions rely upon a signature detection approach. Signature detection involves the scanning of all programs and files installed on a system for the presence of known byte code patterns or signatures. Each signature must match at least one pattern that is characteristic of a reported malware instance.

New variants can remain undetected for a long time, therefore exposing your PC to potential attacks

While signature detection has played a vital role in computer security, it has limitations. A signature cannot be used to detect an unknown threat. A term called the "window of vulnerability" has been coined to measure this vulnerability as the elapsed time between the infection by a malware instance and the availability of a signature for that malware instance. Data from a leading antivirus vendor (Symantec Internet Security Threat Report, Volume XII, September 2007) shows that the window of exposure using signature detection increased from 46 days at the end of 2006 to 55 days in the 1st half of 2007.