The Sonar feature is the behaviour based detection in your Norton product. If it detects a program trying to access something it should not be accessing, it will stop that program and may quarantine the offending file. This is how zero day infections are usually caught.