system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5: How do anti-malware programs determine what is malware and what isn't?

Title.

How does software like that determine malware from its harmless file counterparts? Is there any chance it could remove/quarantine a harmless file/program?
gpt
One of the oldest methods is the signature based detection, this is basically a big list of "this file is bad", unfortunately malware creation kits allow people with no skill to pump out vast numbers of new malware so this method is not viable any more.

Another old method is the heuristic detection, rather than looking for an entire bad program, they look for bits of code used by malware writers, this is great because the automated toolkits that make new versions of the old malware generally just re-arrange older code to try and get past security tools. The problem is you need to rip apart the malware that gets through and update your heuristic signatures. But if the malware gets through how do you know to pick it apart?

One of the more common techniques is to apply a weighting to the program and watch it. If the program starts watching your keyboard, add a few points to the bad side of the scale. If it starts talking to the internet again add "bad" points but not a lot as it could be legitimate. If it accesses a site known to be used by malware, add a whole bunch of "bad" points and so on. Once the program racks up enough bad points kill it and tell the user.

The continuous monitoring of the program is necessary because malware will often be designed to modify itself or download extra bits whilst it is running to try and hide from older types of antivirus software.