Reputation-Based False Positive Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems often produce false positive results due to the inability to validate signatures against all possible innocuous entities, leading to unnecessary alarms and resource wastage.
Innovation Solution
A computer-implemented method and system that evaluates signature detection events by assigning reputation scores to entities based on their health information, determining the likelihood of compromising a client system, and reporting false positive signature detection events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If malware signatures are validated against a limited set of known innocuous entities, then signature generation is feasible and efficient, but false positive detections occur on unvalidated entities
Solution Approach 1:
The system performs preliminary validation of malware signatures against a large corpus of innocuous entities before deploying signatures to production. This advance validation reduces false positives while maintaining efficient signature generation by automating the validation process against pre-collected benign software datasets.
Solution Approach 2:
The system implements feedback mechanisms where false positive detections are collected and analyzed to refine signature validation processes. Validation results from production environments feed back into improving the validation corpus and methods, continuously reducing false positive rates while maintaining generation efficiency.
2Measurement precision
If malware signatures are made highly specific to detect malware accurately, then detection precision improves, but false positive detections increase on innocuous entities
Solution Approach 1:
The system applies different validation strictness levels to different parts of the signature detection process. High-specificity signatures undergo more rigorous validation against targeted innocuous entities, while maintaining overall detection precision. This localized quality control reduces false positives without sacrificing malware detection accuracy.
Solution Approach 2:
The system dynamically adjusts signature matching parameters based on context and validation results. By changing parameters such as match threshold and specificity requirements, the system maintains high detection precision while reducing false positives on innocuous entities that don't match the full signature criteria.
3Reliability
If all possible innocuous entities are validated against malware signatures, then false positive detections are eliminated, but the validation process becomes computationally infeasible
Solution Approach 1:
The validation process is segmented into multiple stages: initial filtering against common benign entities, intermediate validation against category-specific innocuous software, and final targeted validation only for high-risk signatures. This segmentation makes the validation process computationally feasible while maintaining low false positive rates.
Solution Approach 2:
The system performs validation against a representative subset of innocuous entities that covers the majority of false positive scenarios, rather than exhaustively validating against every possible benign entity. This partial action approach achieves sufficient reliability without overwhelming computational complexity.
Data Source
AI summary
A signature is identified in association with an entity at a client. A reputation score associated with the entity is identified, the reputation score indicating a likelihood that the entity will compromise the client. Whether the signature detection event is a false positive signature detection event is evaluated based on the reputation score and reported.