Security Program Coordination to Reduce False Positives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The presence of multiple security programs on a computing device can lead to false positive malware identifications and degrade system performance due to redundant file analyses, as each program may incorrectly identify benign files as malicious.
Innovation Solution
A computer-implemented method and system that identifies a security program configured to analyze files, determines the analysis result, intercepts the analysis attempt, and decides whether to permit the analysis based on the result, preventing redundant analyses of files known to be benign to avoid false positives and improve system performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple security programs are installed on a computing device, then security coverage is improved, but false positive identifications increase
Solution Approach 1:
The patent merges the functionality of multiple security programs by having them report their analysis results to a central system. Instead of operating independently, the security programs are coordinated through a common framework that collects, compares, and validates their findings, thereby reducing false positives while maintaining comprehensive security coverage.
Solution Approach 2:
The system implements feedback mechanisms where analysis results from security programs are shared and validated across the network. When a security program identifies potential malware, the result is fed back to other security programs and the central system for verification, allowing false positives to be corrected through collective feedback and cross-validation.
2Reliability
If multiple security programs analyze the same files, then detection thoroughness is improved, but system performance degrades
Solution Approach 1:
The system performs preliminary actions by having security programs report their analysis results to a central system before actually executing the full analysis. This preliminary result sharing allows the system to determine whether files need to be analyzed by multiple programs or if a single analysis suffices, preventing redundant processing and maintaining system performance.
Solution Approach 2:
The patent applies partial action by having security programs perform only the necessary analysis based on coordinated results. Instead of every program analyzing every file, the system determines the minimum required analysis depth and scope, allowing programs to skip redundant analyses and focus only on files that require thorough examination.
3Adaptability or versatility
If security programs independently analyze files, then analysis independence is maintained, but redundant analyses occur
Solution Approach 1:
The patent introduces a universal coordination framework that all security programs must participate in. This multi-functional system handles result collection, comparison, validation, and coordination across all security programs, enabling them to maintain their independent analysis capabilities while avoiding redundant work through centralized coordination.
Data Source
AI summary
The disclosed computer-implemented method for managing security programs may include (i) identifying a security program configured to analyze files on a client device to detect malicious files, (ii) determining a result the security program would report for an analysis of a file on the client device, (iii) intercepting an attempt by the security program to analyze the file, and (iv) determining, based on the result the security program would report for the analysis of the file, whether to permit the security program to analyze the file. Various other methods, systems, and computer-readable media are also disclosed.