Do antivirus definitions detect suspicious attributes, or is 'definitions' simply a synonym for 'signatures'?

I once heard elsewhere on Yahoo Answers that definitions detect suspicious application attributes, such as the usage of rootkit technology. However, many other sources indicate that 'definitions' is simply a synonym for 'signatures.' This conflict of information between multiple sources has confused me, and I would like a confirmation of which opinion/source is correct. If neither opinions/sources are correct, please specify the correct answer anyway.