Analyzes the behavior of programs and processes to detect suspicious or malicious activities, even if the threat signatures are not yet known.