SONAR is the abbreviation for Symantec Online Network for Advanced Response. Unlike virus signatures, SONAR examines the behavior of applications to decide whether they are malicious. SONAR is built upon technology Symantec acquired in its 2005 purchase of WholeSecurity

WholeSecurity

WholeSecurity was a developer of behavioral anti-malware and anti-phishing software solutions in the United States. Symantec initially announced plans to acquire the company on September 22, 2005 . The company was ultimately acquired on October 5, 2005....

.
An algorithm is used to evaluate hundreds of attributes relating to software running on a computer.