File Classification False Positive Reduction via Flexible Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current classification algorithms for detecting malicious files often result in a high number of false positives, which can persist for an extended period due to the serial nature of their design and improvement processes.
Innovation Solution
A method and system that simultaneously detect malicious files and reduce false positives by analyzing files to determine if they are malicious, identifying false positives, excluding them from further scanning, calculating a flexible hash, and storing it in a database of exceptions to improve future classifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If classification algorithms are designed and improved in a serial process, then the detection algorithm can be refined over time, but the number of false positives remains high for an extended period
Solution Approach 1:
The system performs preliminary actions by immediately analyzing files for false positive outcomes as part of the detection process itself, rather than waiting for a separate improvement phase. When a false positive is detected, the system immediately excludes the file from further scanning and calculates a flexible hash, preparing corrective data in advance to prevent future false positives.
Solution Approach 2:
The system implements feedback by detecting false positive outcomes during the detection process and using this information to immediately adjust the scanning process. The flexible hash calculated from false positive files is stored in a database, providing feedback that prevents similar files from being scanned in the future, thus continuously improving detection quality in real-time.
2Manufacturing precision
If classification algorithms are improved based on further analysis at a later time, then the algorithm can be optimized, but false positives persist for an extended length of time
Solution Approach 1:
The system ensures continuity of useful action by integrating false positive detection and correction into the ongoing detection process itself. Rather than stopping detection to perform improvements, the system continuously detects false positives, calculates flexible hashes, and updates the exception database in real-time, ensuring that detection accuracy improves without interruption.
Solution Approach 2:
The system performs self-service by automatically detecting its own false positives and correcting them through the flexible hash mechanism. The detection algorithm serves itself by using the same analysis process to identify and correct its own errors, eliminating the need for external intervention or separate improvement cycles.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are systems and methods for reducing a number of false positives in classification of files. In one example, an exemplary method comprises, analyzing a file to determine whether or not the file is to be recognized as being malicious, when the file is recognized as being malicious, analyzing the file to detect a false positive outcome, when the false positive outcome is detected, excluding the file from being scanned and calculating a flexible hash of the file, and storing the calculated flexible hash in a database of exceptions.