False Alarm Detection in Malware Scanning via Cleanliness Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Automated malware detection systems often generate false alarms due to the challenge of distinguishing between malicious and clean files, leading to unnecessary customer frustration and increased support requirements.
Innovation Solution
Implementing a dual-scanning approach that uses malware scanning engines to identify potential malware and cleanliness scanning engines to determine if files exhibit properties characteristic of clean files, such as API calls, graphics, sound data, text in multiple languages, and age, with a cleanliness score comparison against a threshold to signal false alarms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated malware scanning is used to detect malware, then scanning speed and coverage are improved, but false alarm rate increases
Solution Approach 1:
The scanning process is divided into two independent stages: a first scanning stage that performs initial malware detection using multiple scanning engines, and a second scanning stage that specifically identifies false alarms by looking for clean file characteristics. This segmentation allows the system to maintain high scanning speed while reducing false alarms through targeted secondary analysis.
Solution Approach 2:
The system performs preliminary scanning to identify potential malware, then applies additional preliminary checks for clean file characteristics before final classification. This preliminary action approach allows the system to catch false alarms early in the process without slowing down the overall scanning operation.
2Measurement precision
If manual analysis is used to verify malware, then detection accuracy is improved, but processing time and cost increase
Solution Approach 1:
The system performs self-service verification by automatically analyzing file characteristics to determine whether positive scan results are false alarms. The system checks for presence of clean file characteristics such as specific file structures, metadata patterns, and behavior profiles, eliminating the need for manual analyst intervention while maintaining high detection accuracy.
Solution Approach 2:
The system incorporates feedback mechanisms where the results of the second scanning stage (identifying false alarms) feed back into the overall detection process. This feedback allows the system to automatically adjust its classification decisions and reduce false positive rates without requiring manual review of each case.
3Adaptability or versatility
If multiple scanning engines are used to improve detection coverage, then malware detection capability is improved, but system complexity increases
Solution Approach 1:
Multiple scanning engines are merged into a unified dual-stage architecture where the first stage combines results from various scanning engines to identify potential malware, and the second stage combines multiple analysis techniques to identify false alarms. This merging approach maintains comprehensive detection coverage while managing complexity through structured integration.
Solution Approach 2:
The scanning system is designed with multi-functionality where the same infrastructure supports both malware detection and false alarm identification. The second scanning stage serves multiple purposes: verifying clean files, identifying false alarms, and providing feedback for system improvement, thereby reducing overall system complexity despite using multiple scanning engines.
Data Source
Figure 1~2
AI summary
A method of scanning files for malware on a computer system. The method comprises receiving a file to be scanned in the system, and using at least one malware scanning engine to determine whether or not the file possesses properties that are indicative of malware. If it is determined that the file does possess properties that are indicative of malware, then at least one cleanliness scanning engine is used to determine whether or not the file possesses properties that are indicative of a clean file. If it is determined that the file possesses properties that are indicative of a clean file, then a false alarm is signalled.