False Positive Suppression for Malware Detection Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection models often produce false positive results, which can negatively impact user experience and system performance, and current methods for suppressing these false positives are either too broad, leading to reduced model efficacy, or too specific, requiring manual and time-consuming processes prone to human error.
Innovation Solution
A false positive suppressor system that automatically derives rules to identify and suppress false positive malware detections by analyzing features of executable files, using machine-learning models to differentiate between legitimate and malicious files, thereby reducing manual intervention and improving scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If malware detection models are made more sensitive to detect all malicious files, then detection accuracy improves, but false positive rate increases
Solution Approach 1:
The system segments the malware detection process into two independent stages: (1) initial detection by a sensitive malware detection model, and (2) verification by a separate false positive identification model. This segmentation allows each model to be optimized for its specific function without compromising the other, resolving the contradiction between high sensitivity and low false positive rate.
Solution Approach 2:
The false positive identification model acts as an intermediary between the malware detection model and the final detection decision. It receives outputs from the detection model and filters out false positives before final classification, thereby maintaining high detection accuracy while reducing false positive rate.
2Reliability
If suppression rules are made more specific to reduce false positives, then false positive rate decreases, but manual effort and time increase
Solution Approach 1:
The false positive identification model operates autonomously to generate and apply suppression rules without requiring manual intervention. The system self-services by automatically learning from false positive patterns and updating suppression rules, thereby reducing false positive rate while minimizing time loss.
Solution Approach 2:
The system performs preliminary analysis of detection outputs using the false positive identification model before final classification. This preliminary action automatically identifies potential false positives and applies appropriate suppression rules in advance, reducing the need for subsequent manual review and time investment.
3Reliability
If suppression rules are made more broad to cover more false positives, then false positive rate decreases, but detection efficacy is reduced
Solution Approach 1:
The false positive identification model applies different suppression strategies locally based on the specific characteristics of each detection output. Instead of applying broad uniform suppression, the system tailors suppression rules to match specific false positive patterns, thereby reducing false positives while preserving detection efficacy for legitimate threats.
Solution Approach 2:
The system dynamically adjusts suppression parameters based on the confidence scores and feature patterns of detection outputs. By changing suppression thresholds and rule applicability parameters locally rather than globally, the system maintains high false positive reduction while preserving detection efficacy.
Data Source
AI summary
Methods, apparatus, systems, and articles of manufacture are disclosed for suppression of false positive malware detection. An example apparatus includes at least one memory, machine-readable instructions, and processor circuitry to at least one of instantiate or execute the machine-readable instructions to execute a machine-learning model based on a feature associated with an executable file to generate a malware detection output. The processor circuitry is further to, identify, after a first determination that the malware detection output identifies the executable file as malware, the malware detection output as a false positive malware detection output based on the feature invoking a false positive suppression rule. Additionally, the processor circuitry is to cause execution of the executable file based on the identification of the malware detection.