Adaptive Blacklist Override for False Positive Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware systems using blacklists and whitelists often result in false positives, where legitimate programs are blocked or require administrative intervention for removal, leading to user frustration and security inefficiencies.
Innovation Solution
A system that utilizes one or more blacklists to determine if a program is safe to run, providing administrators with options to allow execution of programs based on rules such as directory paths, certifications, and user behavior, allowing for automated overrides and updates to prevent malicious software execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklisting is used to prevent malicious software, then security is improved, but false positives increase causing legitimate programs to be blocked
Solution Approach 1:
The system dynamically adjusts blacklist enforcement by introducing override mechanisms that allow legitimate programs to bypass blacklist restrictions. Administrators can configure exceptions based on program behavior patterns, directory paths, and execution contexts, making the security system adaptive rather than static.
Solution Approach 2:
The patent introduces an intermediary evaluation layer between the blacklist and program execution. This intermediary assesses whether blacklisted programs should be allowed to run by checking override rules, administrator approvals, and behavioral heuristics, thus mediating between security restrictions and program execution needs.
2Reliability
If blacklisting is used to block malicious programs, then security is improved, but administrative complexity increases due to manual review requirements
Solution Approach 1:
The system provides self-service capabilities by automatically evaluating programs against override rules and behavioral patterns. The automated evaluation process reduces the need for manual administrator intervention, allowing the system to handle routine blacklist exceptions without human involvement while maintaining security.
Solution Approach 2:
The patent implements preliminary action by pre-configuring override rules and approval workflows before blacklist enforcement issues problems. Administrators can set up behavioral patterns, directory exceptions, and approval hierarchies in advance, so that when blacklist conflicts arise, the system can resolve them using pre-established criteria rather than requiring immediate manual review.
3Reliability
If blacklisting is used to prevent malware execution, then security is improved, but user convenience decreases due to blocking of trusted programs
Solution Approach 1:
The system incorporates feedback mechanisms where user interactions and program execution patterns are monitored and fed back into the evaluation system. When users consistently execute certain blacklisted programs from trusted locations or with specific parameters, the system learns from this feedback and adjusts its blocking behavior, eventually allowing these programs to run without interruption.
Solution Approach 2:
The intermediary evaluation layer acts as a mediator between security policies and user needs. It transparently evaluates whether blacklisted programs should be blocked based on contextual factors like execution location, user credentials, and behavioral patterns, allowing trusted programs to run smoothly while maintaining security controls for genuinely malicious software.
Data Source
AI summary
A computer security system with enhanced blacklisting includes administrative interfaces that accept user inputs to create and modify entries in a blacklist and a whitelist that define which programs are allowed to execute on one or more target computer systems. Upon an attempt to run a program, if the program is in the blacklist and not in the white list, the program is prevented from running. If the program is prevented from running, at a later time, an administrative interface is used to either block future execution of the program or to create an entry in the whitelist that allows future execution of a class of programs or only that the program until revoked. The whitelists and blacklists are for a single target computer or many computers.