Antivirus software is by definition a black list approach. A white list approach means code signing. iOS does that. It works fairly well in conjunction with cer

Antivirus software is by definition a black list approach. A white list approach means code signing. iOS does that. It works fairly well in conjunction with certificate revocation for anything bad that managed to be signed by a trusted certificate. That means you have both a whitelist (that is append only) and a blacklist (to fix mistakes in the append only whitelist).