A behavior-based AV scans a file by running the software in a simulated environment (e.g. a sandbox or VM) and observing its execution (e.g. monitor network traffic, filesystem read/writes, etc).
A behavior-based AV scans a file by running the software in a simulated environment (e.g. a sandbox or VM) and observing its execution (e.g. monitor network traffic, filesystem read/writes, etc).