Anti-Malware False Positive Detection via Hash Collision Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-malware systems face challenges in effectively detecting and minimizing false positives, leading to inconvenience and potential harm, as they rely on outdated signature scanning, integrity checking, and white list updates that are often manual and time-consuming, resulting in delayed corrections and frequent false alarms.
Innovation Solution
A system and method that calculates the probability of detection for potential malware objects to correct white lists and update black lists in two phases: before and after the creation of new anti-virus databases, utilizing collision analysis and context-based verdict generation to minimize false positives and facilitate timely updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature scanning is used to detect viruses, then known malicious code can be detected, but unknown or modified viruses cannot be detected
Solution Approach 1:
The system performs preliminary actions by pre-calculating and storing hash values of legitimate files in a white list before infections occur. This allows rapid identification of known good files without requiring real-time analysis of unknown malware signatures.
Solution Approach 2:
The system creates a copy of the file system state by generating hash values of legitimate files and storing them in a white list. This copy allows the system to identify malicious files by comparing their hashes against the stored legitimate file hashes, enabling detection of unknown variants.
2Reliability
If integrity checking is used to detect virus modifications, then file modifications can be detected, but legitimate updates cause false warnings
Solution Approach 1:
The system applies local quality by creating separate white lists for different types of legitimate files (executables, DLLs, system files) with their specific hash values. This allows the system to make localized decisions about whether a file modification is legitimate or malicious based on the specific file type and its expected hash value.
Solution Approach 2:
The system implements feedback by continuously monitoring file hashes and comparing them against the white list. When a file's hash changes, the system provides feedback by determining whether the change represents a legitimate update (by checking if the new hash matches an expected value in the white list) or a virus infection.
3Reliability
If white lists are manually updated to correct false positives, then detection accuracy improves, but the process is time-consuming and delayed
Solution Approach 1:
The system performs self-service by automatically detecting false positives through collision analysis between white list and black list entries. When a collision is detected (where a file is simultaneously whitelisted and blacklisted), the system automatically resolves the conflict by analyzing the file's hash values and determining the correct classification, eliminating the need for manual analyst intervention.
Solution Approach 2:
The system replaces the mechanical manual update process with an automated computational system. Instead of requiring human analysts to manually review and update white lists, the system uses automated collision detection and resolution algorithms that process false positives instantly based on hash value comparisons and file analysis.
4Reliability
If collision analysis is performed between white list and black list, then false positives can be detected, but system complexity increases
Solution Approach 1:
The system merges the white list and black list collision detection into a unified process. Instead of maintaining completely separate detection systems, the patent combines the hash value comparison logic for both lists into a single collision analysis mechanism that processes both whitelisted and blacklisted files through the same analytical framework, reducing overall system complexity.
Data Source
AI summary
A system, method and computer program product for detection of false positives occurring during execution of anti-malware applications. The detection and correction of the false positives is implemented in two phases, before creation of new anti-virus databases (i.e., malware black lists) or before creation of new white lists, and after the anti-virus databases or new white lists are created and new false positives are detected. The system calculates a probability of detection of a certain potential malware object. Based on this probability, the system decides to either correct a white list (i.e., a collection of known clean objects) or update a black list (i.e., a collection of known malware objects). A process is separated into a several steps: creation and update (or correction) of white lists; creation and update of black lists; detection of collisions between these lists and correction of black lists or white lists based on the detected collisions.