This is a newer approach borrowed from intrusion detection system (IDS) technologies and uses policies to define which kinds of system behaviors might indicate the presence of a virus infection. Should an action occur that violates such a policy, such as code trying to access the address book to mass mail itself through e-mail, the software steps in and prevents this from happening and can also isolate the suspect code in a “sandbox” until the administrator decides what to do with it. The advantage of behavior-blocking detection is that it can detect new viruses for which no signatures are known. The disadvantage is that, like IDSs, such detection systems can generate false positives if the detection threshold is set too low or can miss real infections if it is set too high. A few newer virus protection products include behavior-blocking technology, but most still operate using signature databases.