By thinking outside the box! :-p
There are two types of viruses, internal acting and external acting.
Internal ones are trying to muck up the system. These should be fairly easy to identify if we actually had real sandboxing operating systems. It would be nice if an AI identified them, suspended them, and then told the user about it.
The external ones: How do you tell the difference between pockymon go and a virus telling the world all your information. Well, this is most easily done with actually understanding the internet. Like, this program is wanting to go out to shady bars in the slum parts of town... suspicious.
Lots of work to be done in this field. But it probably won't take off until microsloth is forced to clean up their act. When the real pushback to big brother happens.
the external one is more known as a Worm I would think. Still get's lumped in with viruses when talking of detection though.