IP Library › Granted Patent US 12694111

Granted Patent B2

US 12694111 · App. 18/068,298 · Granted Jul 28, 2026

Apparatus, articles of manufacture, and methods for suppression of false positive malware detection

Inventor: Niall Fitzgerald (Cork, IE)

Assignee: McAfee, LLC

G06F21/568 G06F21/53

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12694111
App. No.: 18/068,298
Granted: Jul 28, 2026
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Methods, apparatus, systems, and articles of manufacture are disclosed for suppression of false positive malware detection. An example apparatus includes at least one memory, machine-readable instructions, and processor circuitry to at least one of instantiate or execute the machine-readable instructions to execute a machine-learning model based on a feature associated with an executable file to generate a malware detection output. The processor circuitry is further to, identify, after a first determination that the malware detection output identifies the executable file as malware, the malware detection output as a false positive malware detection output based on the feature invoking a false positive suppression rule. Additionally, the processor circuitry is to cause execution of the executable file based on the identification of the malware detection.

Claims (55)

1 . An apparatus comprising:

at least one memory;

machine-readable instructions; and

processor circuitry to at least one of instantiate or execute the machine-readable instructions to:

execute a machine-learning model based on a feature associated with an executable file to generate a malware detection output;

identify, after a first determination that the malware detection output identifies the executable file as malware, the malware detection output as a false positive malware detection output based on the feature associated with the executable file invoking false positive suppression rules, wherein the false positive suppression rules are generated based on an execution of a rulefit model trained on false positive detections of malware and non-false positive detections of malware, and wherein the false positive suppression rules include a first false positive suppression rule corresponding to a file size of the executable file and a second false positive suppression rule corresponding to a name of the executable file; and

cause execution of the executable file based on the identification of the malware detection output as the false positive malware detection output.

2 . The apparatus of claim 1 , wherein the malware detection output is a first malware detection output, the feature associated with the executable file is a first feature associated with the executable file, and wherein the processor circuitry is to identify a second malware detection output as a true positive malware detection output based on a second feature associated with the executable file not invoking the false positive suppression rule.

3 . The apparatus of claim 2 , wherein the processor circuitry is to execute a malware protection operation based on the identification of the second malware detection output as the true positive malware detection output.

4 . The apparatus of claim 3 , wherein the malware protection operation is one of a quarantining of the executable file, a halting of the execution of the executable file, a prevention of the execution of the executable file, a deletion of the executable file, or a sandboxing of the executable file.

5 . The apparatus of claim 1 , wherein the executable file is a portable execution file included in a container file.

6 . The apparatus of claim 1 , wherein the feature is a signature, a type of machine on an endpoint device, a number of sections of a section table, or a size of a header of the executable file.

7 . The apparatus of claim 1 , wherein the feature associated with the executable file is a first feature associated with the executable file, the executable file is a first executable file, the malware detection output is a first malware detection output, and the processor circuitry is further to:

identify second malware detection outputs associated with second executable files as false positive malware detection outputs;

generate first data associations of the false positive malware detection outputs and second features of the second executable files;

identify third malware detection outputs associated with third executable files as non-false positive malware detection outputs;

generate second data associations of the non-false positive malware detection outputs and third features of the third executable files; and

execute the rulefit model based on the first data associations and the second data associations to output the false positive suppression rule.

8 . The apparatus of claim 7 , wherein the processor circuitry is to cause transmission of the false positive suppression rules to an endpoint device.

9 . At least one non-transitory computer readable storage medium comprising instructions that, when executed, cause processor circuitry to at least:

execute a machine-learning model based on a feature associated with an executable file to generate a malware detection output;

after a first determination that the malware detection output identifies the executable file as malware, identify the malware detection output as a false positive malware detection output based on the feature associated with the executable file invoking false positive suppression rules, wherein the false positive suppression rules are generated based on an execution of a rulefit model trained on false positive detections of malware and non-false positive detections of malware, and wherein the false positive suppression rules include a first false positive suppression rule corresponding to a file size of the executable file and a second false positive suppression rule corresponding to a name of the executable file; and

cause execution of the executable file based on the identification of the malware detection output as the false positive malware detection output.

10 . The at least one non-transitory computer readable storage medium of claim 9 , wherein the malware detection output is a first malware detection output, the feature associated with the executable file is a first feature associated with the executable file, and wherein the instructions are to cause the processor circuitry to identify a second malware detection output as a true positive malware detection output based on a second feature associated with the executable file not invoking the false positive suppression rule.

11 . The at least one non-transitory computer readable storage medium of claim 10 , wherein the instructions are to cause the processor circuitry to execute a malware protection operation based on the identification of the second malware detection output as the true positive malware detection output.

12 . The at least one non-transitory computer readable storage medium of claim 11 , wherein the instructions are to cause the processor circuitry to execute the malware protection operation as one of a quarantining of the executable file, a halting of the execution of the executable file, a prevention of the execution of the executable file, a deletion of the executable file, or a sandboxing of the executable file.

13 . The at least one non-transitory computer readable storage medium of claim 9 , wherein the executable file is a portable execution file included in a container file.

14 . The at least one non-transitory computer readable storage medium of claim 9 , wherein the feature is a signature, a type of machine on an endpoint device, a number of sections of a section table, or a size of a header of the executable file.

15 . The at least one non-transitory computer readable storage medium of claim 9 , wherein the feature associated with the executable file is a first feature associated with the executable file, the executable file is a first executable file, the malware detection output is a first malware detection output, and the instructions are to cause the processor circuitry to:

identify second malware detection outputs associated with second executable files as false positive malware detection outputs;

generate first data associations of the false positive malware detection outputs and second features of the second executable files;

identify third malware detection outputs associated with third executable files as non-false positive malware detection outputs;

generate second data associations of the non-false positive malware detection outputs and third features of the third executable files; and

execute the rulefit model based on the first data associations and the second data associations to output the false positive suppression rule.

16 . The at least one non-transitory computer readable storage medium of claim 15 , wherein the instructions are to cause the processor circuitry to cause transmission of the false positive suppression rules to an endpoint device.

17 . A method comprising:

executing, by executing an instruction with a processor, a machine-learning model based on a feature associated with an executable file to generate a malware detection output;

after a first determination that the malware detection output identifies the executable file as malware, identifying, by executing an instruction with the processor, the malware detection output as a false positive malware detection output based on the feature invoking false positive suppression rules, wherein the false positive suppression rules are generated based on an execution of a rulefit model trained on false positive detections of malware and non-false positive detections of malware, and wherein the false positive suppression rules include a first false positive suppression rule corresponding to a file size of the executable file and a second false positive suppression rule corresponding to a name of the executable file; and

executing, by executing an instruction with the processor, the executable file based on the identification of the malware detection output as the false positive malware detection output.

18 . The method of claim 17 , wherein the malware detection output is a first malware detection output, the feature associated with the executable file is a first feature associated with the executable file, and further including identifying a second malware detection output as a true positive malware detection output based on a second feature associated with the executable file not invoking the false positive suppression rules.

19 . The method of claim 18 , further including executing a malware protection operation based on the identification of the second malware detection output as the true positive malware detection output.

20 . The method of claim 19 , wherein the malware protection operation is one of a quarantining of the executable file, a halting of the execution of the executable file, a prevention of the execution of the executable file, a deletion of the executable file, or a sandboxing of the executable file.

21 . The method of claim 17 , wherein the executable file is a portable execution file included in a container file.

22 . The method of claim 17 , wherein the feature is a signature, a type of machine on an endpoint device, a number of sections of a section table, or a size of a header of the executable file.

23 . The method of claim 17 , wherein the feature associated with the executable file is a first feature associated with the executable file, the executable file is a first executable file, the malware detection output is a first malware detection output, and the method further including:

identifying second malware detection outputs associated with second executable files as false positive malware detection outputs;

generating first data associations of the false positive malware detection outputs and second features of the second executable files;

identifying third malware detection outputs associated with third executable files as non-false positive malware detection outputs;

generating second data associations of the non-false positive malware detection outputs and third features of the third executable files; and

executing the rulefit model based on the first data associations and the second data associations to output the false positive suppression rules.

24 . The method of claim 23 , further including transmitting the false positive suppression rules to an endpoint device.

25 . An apparatus comprising:

means for executing a machine-learning model based on a feature associated with an executable file to generate a malware detection output;

means for identifying, after a first determination that the malware detection output identifies the executable file as malware, the malware detection output as a false positive malware detection output based on the feature invoking false positive suppression rules, wherein the false positive suppression rules are generated based on an execution of a rulefit model trained on false positive detections of malware and non-false positive detections of malware, and wherein the false positive suppression rules include a first false positive suppression rule corresponding to a file size of the executable file and a second false positive suppression rule corresponding to a name of the executable file; and

means for causing execution of the executable file based on the identification of the malware detection output as the false positive malware detection output.