Pestware Detection Reducing False Positives via User Activity Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software for detecting and managing pestware often provides false alarms, unable to distinguish between user-initiated activities and pestware activities, leading to user frustration and potential disabling of warning capabilities.
Innovation Solution
A method that tracks user activities and monitors events on a protected computer, using a heuristic engine to compare user actions with potential pestware indicators, reducing false-positive alerts by informing the user only when the comparison indicates the activity is unconnected to the user's actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software monitors all events on a computer to detect pestware, then detection capability is improved, but false positive rate increases
Solution Approach 1:
The patent segments event monitoring into two distinct categories: user-initiated events and system-generated events. By dividing the monitoring scope and applying different analysis rules to each segment, the system achieves both comprehensive detection and reduced false positives. User events are analyzed for pestware indicators while system events are evaluated separately based on their automated nature.
Solution Approach 2:
The patent implements preliminary classification of events before full pestware analysis. Events are pre-categorized as either user-initiated or system-generated, allowing the system to apply appropriate detection thresholds and rules beforehand. This preliminary action prevents misclassification and reduces false positives by ensuring events are evaluated with the correct context.
2Loss of information
If software provides warnings for all suspicious activities, then user awareness is improved, but user frustration increases
Solution Approach 1:
The patent applies local quality by providing different levels of warning based on event characteristics. High-confidence pestware events trigger detailed warnings with actionable information, while low-confidence or clearly benign events receive minimal or no notification. This localized approach ensures users are informed of real threats without being overwhelmed by false alarms.
Solution Approach 2:
The patent implements partial action by selectively warning users only about events that meet specific confidence thresholds and criteria. Rather than alerting users to every suspicious event, the system applies warning action only when the evidence sufficiently indicates pestware, thereby maintaining user awareness while avoiding excessive frustration from minor or false alerts.
3Ease of operation
If software disables warning capabilities to reduce frustration, then user experience is improved, but security protection deteriorates
Solution Approach 1:
The patent implements feedback mechanisms that allow users to interact with warnings and provide input about false positives. The system learns from user feedback to adjust its detection sensitivity and warning thresholds over time. This creates a balanced security protection that adapts to user needs while maintaining reliable pestware detection, preventing complete disabling of warnings.
Solution Approach 2:
The patent makes the warning system dynamic by adjusting its sensitivity and activation thresholds based on accumulated data and user behavior patterns. The system can dynamically modify which events trigger warnings and at what confidence levels, ensuring security protection remains effective while adapting to reduce user frustration over time.
Data Source
AI summary
A system and method for reducing false positive indications of pestware on a protected computer is disclosed. In one variation, the method includes tracking activities of a user at the protected computer, monitoring events at the protected computer, identifying events that are potentially indicative of pestware, comparing at least one of the events with at least one of the activities of the user and initiating, in response to the comparing indicating the activities of the user are unconnected with the events, a user prompt that informs the user about the events to enable the user to make a decision relative to managing the events.