Antivirus Record Correction for False Positive Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems face challenges in accurately updating databases to prevent false malware detections, as they often rely on human expertise and may incorrectly identify clean software as malicious, leading to inefficient operations and resource-intensive processes.
Innovation Solution
A system and method that involves an antivirus application on a user's computing device checking antivirus records with a server for corrections, using statistical information from multiple devices to determine the status of software objects, and applying correction rules to minimize false detections by changing the status of records from 'working' or 'test' to 'inactive' to avoid notifications and block further data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus records are continuously updated with new malware signatures, then malware detection capability is improved, but false positive detections increase
Solution Approach 1:
The system performs preliminary verification of antivirus records against a whitelist database before they are activated for malware detection. This preliminary action prevents false positives by checking whether the target object exists in the whitelist (indicating it is a known clean application) before the antivirus record is applied, thus avoiding the harmful effect of false positive detections while maintaining reliable malware detection
Solution Approach 2:
The whitelist database serves as an intermediary between the antivirus detection system and the files on the user's device. When an antivirus record identifies a potential malware, the system checks this intermediary whitelist to verify whether the object is actually clean. This intermediary mechanism resolves the contradiction by providing an additional verification layer that prevents false positives while allowing aggressive malware detection
2Measurement precision
If heuristic analysis and sandbox execution are used to detect unknown malware, then detection accuracy is improved, but system resources and time consumption increase
Solution Approach 1:
The system performs preliminary checks using the whitelist database and antivirus records before initiating resource-intensive heuristic analysis or sandbox execution. By first verifying whether an object matches known malware signatures or exists in the whitelist, the system可以避免 unnecessary execution of time-consuming verification procedures, thus reducing time loss while maintaining high detection accuracy for unknown malware
Solution Approach 2:
The system applies a tiered verification approach where not all objects undergo full heuristic analysis or sandbox execution. Instead, only objects that pass initial filtering (match antivirus signatures and fail whitelist verification) are subjected to partial or full verification. This partial action approach maintains high detection accuracy for suspicious objects while minimizing time consumption for the majority of clean objects
3Reliability
If proactive verification methods are fully utilized, then malware detection effectiveness is improved, but user experience deteriorates due to notifications and resource usage
Solution Approach 1:
The system performs preliminary verification of all objects against the whitelist database and antivirus records before activating proactive verification methods. This preliminary action ensures that only objects with actual malware risk undergo resource-intensive verification and trigger user notifications. By filtering out clean objects in advance, the system maintains effective malware detection while avoiding unnecessary user notifications and resource consumption that would deteriorate user experience
Solution Approach 2:
The system automatically manages the verification process and notification generation without requiring user intervention. The whitelist database and antivirus records self-service by automatically identifying and blocking clean objects, allowing proactive verification to focus only on suspicious objects. This self-service mechanism maintains detection effectiveness while improving user experience by eliminating spurious notifications
Data Source
AI summary
Disclose are system, method and computer program product for detection of malware on a user's computing device. An exemplary method comprises: detecting, by an antivirus application executing of the user's computing device, that an antivirus record is activated on the computing device for detecting a maliciousness of a software object, the antivirus record having a selected status indicator indicating at least one of: a working record, a test record, or an inactive record; in response to detecting the antivirus record having working or test status, checking, by the antivirus application, for a correction of the antivirus record with an antivirus server, wherein said correction includes a change in the status of the antivirus record; in response to receiving from the antivirus server the correction of the antivirus record, using by the antivirus application said correction for processing of the software object.