(1) For human behavior detection, see
people analytics.
(2) Also known as "sandboxing," it is antivirus software that monitors the executable actions of potentially malicious software and prevents certain operations from taking place. Deleting files and modifying system settings are the kinds of actions that are prohibited. Behavior detection is effective, because a polymorphic virus changes its signature (binary pattern of the file) each time another user encounters it, and a single signature cannot suffice for each type of virus. See
polymorphic virus,
sandbox and
antivirus program.