PUP was classified differently before. Also, be aware that having PUP enabled for real-time is not a good idea because it'll make many installers with promotional software fail entirely. Which is not desired. PUP should be enabled by default for On-Demand scans though. I use it in such way, I make a full system scan once in a full moon to see if any undesired PUP's sneaked in. But they are usually just annoyance and not something horrible.
As for the Identity Protection (Software Analyzer), I think they use two methods, which could broadly be classified under "Confirmed behavior" and "Suspicious behavior". First one (Known threats) is very strict behavior detection which hardly ever generates false positives, but covers a narrower range of malware. Second one (Detected) means more broad and generic behavior monitoring which can sometimes trigger false positive detections. That's how I understood AVG's IDP system. It's why they have (at least in last stable AVG itself) IDP enabled for known threats to be quarantined directly without prompts.
