system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5: How do antiviruses first discover malware?

If someone creates a new piece of malware, like a botnet or virus, how does the antivirus company find the malware in the first place, so that they can include it in their AV database. Obviously it's pretty simple to detect things that completely wreck your system, but how do they discover the more covert stuff?
gpt
first, with signatures: they compare the suspicious file to a database of known viruses, and see if it matches. this only works with viruses that have already been discovered. 

second, with heuristics: they examine the behavior of the file or process and see if it's doing anything suspicious. if a process is sending a packet over the internet every time you hit a key on your keyboard, it's probably a keylogger; by monitoring communications patterns and memory access patterns, some viruses make themselves known even if they've never been seen before. heuristic detection is extremely unreliable. 

most of the time antiviruses rely on signatures. this is why you have to constantly update new virus definitions from your antivirus provider; they employ full-time security researchers whose job it is to browse the web, gather and identify new viruses, and determine how to detect and remove them.