Malware Detection False Positive Reduction via Trust Levels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware products often result in decreased computer performance due to frequent file and subsystem analysis, especially when assessment rules change, leading to false positive malware detection and minimal benefit for systems without malware.
Innovation Solution
A method and apparatus that utilize a 'white list' to reduce unnecessary monitoring by identifying trustworthy files and using a backend system to determine trustworthiness levels, designating files as false or true positives based on these levels, and employing a 'community presence' trust level to minimize false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-malware products monitor and analyze files on every access using assessment rules, then malware detection capability is improved, but client computer performance deteriorates
Solution Approach 1:
The system performs preliminary analysis of files using multiple assessment rules before they are accessed, and caches the results. This preliminary action allows the system to quickly retrieve pre-analyzed results during actual file access operations, maintaining high malware detection capability while avoiding the performance penalty of re-analyzing files on every access.
Solution Approach 2:
The system applies different assessment rules and analysis depths to different files based on their characteristics, location, and risk profile. Rather than uniformly analyzing all files with the same rigor, the system tailors the assessment approach to each file's specific context, improving detection accuracy for high-risk files while reducing overhead for low-risk files.
2Measurement precision
If anti-malware products invalidate cached analysis results when assessment rules change, then detection accuracy is improved, but computer performance deteriorates further
Solution Approach 1:
The system dynamically manages cache validity by tracking which assessment rules have been modified and selectively invalidating only the cached results that depend on those specific rules. This dynamic approach maintains detection accuracy by ensuring outdated results are not used, while preserving performance by keeping valid cached results accessible.
Solution Approach 2:
The system associates each cached result with the specific version of assessment rules used to generate it. When rules change, the system changes the validity parameter of related cache entries, allowing it to distinguish between cached results that remain valid and those that must be re-analyzed, thus maintaining accuracy without unnecessary performance degradation.
3Reliability
If anti-malware products analyze all files including those without malware, then comprehensive security coverage is improved, but false positive detection increases
Solution Approach 1:
The system applies different levels of scrutiny to different files based on their characteristics. Files from trusted sources, commonly used applications, and files with clean historical records receive lighter assessment with lower false positive risk, while files from untrusted sources or exhibiting suspicious characteristics undergo more rigorous analysis. This localized quality approach maintains comprehensive security coverage while reducing false positives.
Solution Approach 2:
The system applies assessment rules selectively rather than uniformly to all files. For files with low risk indicators, the system applies a subset of assessment rules (partial action) that is sufficient for security coverage but less likely to trigger false positives. For high-risk files, the system applies the full suite of assessment rules (excessive action) to ensure thorough detection.
Data Source
AI summary
Method and apparatus for detecting malware are described. In some examples, files of unknown trustworthiness are identified as potential threats on the computer. A trustworthiness level for each of the files is received from a backend. The trustworthiness level of each of the files is compared to a threshold level. Each of the files where the trustworthiness level thereof satisfies the threshold level is designated as a false positive threat. Each of the files where the trustworthiness level thereof does not satisfy the threshold level is designated as a true positive threat.