File Classification False Positive Reduction via Flexible Hashing

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current classification algorithms for detecting malicious files often result in a high number of false positives, which can persist for an extended period due to the serial nature of their design and improvement processes.

Innovation Solution

A method and system that simultaneously detect malicious files and reduce false positives by analyzing files to determine if they are malicious, identifying false positives, excluding them from further scanning, calculating a flexible hash, and storing it in a database of exceptions to improve future classifications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If classification algorithms are designed and improved in a serial process, then the detection algorithm can be refined over time, but the number of false positives remains high for an extended period

Engineering Contradiction:
Improvedetection qualityVSAvoidtime to reduce false positives
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by immediately analyzing files for false positive outcomes as part of the detection process itself, rather than waiting for a separate improvement phase. When a false positive is detected, the system immediately excludes the file from further scanning and calculates a flexible hash, preparing corrective data in advance to prevent future false positives.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The system implements feedback by detecting false positive outcomes during the detection process and using this information to immediately adjust the scanning process. The flexible hash calculated from false positive files is stored in a database, providing feedback that prevents similar files from being scanned in the future, thus continuously improving detection quality in real-time.

Inventive Principle:
Principle #23Feedback

2Manufacturing precision

If classification algorithms are improved based on further analysis at a later time, then the algorithm can be optimized, but false positives persist for an extended length of time

Engineering Contradiction:
Improveclassification accuracyVSAvoidduration of false positive persistence
Core Design Contradiction:
Manufacturing precisionVSDuration of action of stationary object

Solution Approach 1:

The system ensures continuity of useful action by integrating false positive detection and correction into the ongoing detection process itself. Rather than stopping detection to perform improvements, the system continuously detects false positives, calculates flexible hashes, and updates the exception database in real-time, ensuring that detection accuracy improves without interruption.

Inventive Principle:
Principle #20Continuity of useful action

Solution Approach 2:

The system performs self-service by automatically detecting its own false positives and correcting them through the flexible hash mechanism. The detection algorithm serves itself by using the same analysis process to identify and correct its own errors, eliminating the need for external intervention or separate improvement cycles.

Inventive Principle:
Principle #25Self-service

Data Source

PatentEP3792799B1System and method of reducing a number of false positives in classification of files
Publication Date: 2025.01.22 AO KASPERSKY LAB
  • EP3792799B1 patent drawingFigure 1
  • EP3792799B1 patent drawingFigure 2
  • EP3792799B1 patent drawingFigure 3

AI summary

Disclosed herein are systems and methods for reducing a number of false positives in classification of files. In one example, an exemplary method comprises, analyzing a file to determine whether or not the file is to be recognized as being malicious, when the file is recognized as being malicious, analyzing the file to detect a false positive outcome, when the false positive outcome is detected, excluding the file from being scanned and calculating a flexible hash of the file, and storing the calculated flexible hash in a database of exceptions.