sentences:  SONAR is built upon technology Symantec acquired in its late 2005 purchase of WholeSecurity, a developer of behavioral anti-malware and anti-phishing software solutions in the United States.An algorithm is used to evaluate hundreds of attributes relating to software running on a computer.Various factors are considered before determining that a program is malicious, such as if the program adds a shortcut on the desktop or creates a "Windows Add/Remove programs" entry.