Systems and methods for managing security programs

1. A computer-implemented method for managing security programs, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying a security program configured to analyze files on a client device to detect malicious files;

determining a result the security program would report for an analysis of a file on the client device, wherein determining the result the security program would report comprises submitting the file for analysis by the security program;

intercepting an attempt by the security program to analyze the file; and

determining, based on the result the security program would report for the analysis of the file and based on stored data indicating whether the file is known to be benign, whether to permit the security program to analyze the file, wherein a file that is known to be benign is not malicious;

wherein, based on the result the security program would report is that the file is malicious, and based on the stored data indicating that the file is known to be benign, the security program is not permitted to analyze the file to prevent a false positive identification of the file as being malicious.

2. The computer-implemented method of claim 1 , wherein the file is known to be benign because the stored data comprises file analysis results and file metadata that indicate the file has not been modified since a previous security analysis determined that the file is benign.

3. The computer-implemented method of claim 1 , wherein the file is known to be benign because the stored data comprises file metadata that indicates the file has a benign file type.

4. The computer-implemented method of claim 1 , wherein the file is known to be benign because the stored data comprises file metadata that indicates the file was digitally signed by a trusted party.

5. The computer-implemented method of claim 1 , wherein the file is known to be benign because the stored data comprises file reputation data that indicates the file was previously determined to have a good reputation.

6. The computer-implemented method of claim 1 , wherein determining the result the security program would report for the analysis of the file comprises retrieving, from a database of results of file analyses by the security program, a result of a previous analysis of the file.

7. A system for managing security programs, the system comprising:

an identification module, stored in memory, that identifies a security program configured to analyze files on a client device to detect malicious files;

an analysis module, stored in memory, that determines a result the security program would report for an analysis of a file on the client device, wherein determining the result the security program would report comprises submitting the file for analysis by the security program;

an interception module, stored in memory, that intercepts an attempt by the security program to analyze the file;

a control module, stored in memory, that determines, based on the result the security program would report for the analysis of the file and based on stored data indicating whether the file is known to be benign, whether to permit the security program to analyze the file, wherein a file that is known to be benign is not malicious; and

at least one physical processor configured to execute the identification module, the analysis module, the interception module, and the control module;

wherein, based on the analysis module determining that the security program would report that the file is malicious, and based on the stored data indicating that the file is known to be benign, the control module does not permit the security program to analyze the file to prevent a false positive identification of the file as being malicious.

8. The system of claim 7 , wherein the analysis module determines that the file is known to be benign because the stored data comprises file analysis results and file metadata that indicate the file has not been modified since a previous security analysis determined that the file is benign.

9. The system of claim 7 , wherein the analysis module determines that the file is known to be benign because the stored data comprises file metadata that indicates the file has a benign file type.

10. The system of claim 7 , wherein the analysis module determines that the file is known to be benign because the stored data comprises file metadata that indicates the file was digitally signed by a trusted party.

11. The system of claim 7 , wherein the analysis module determines that the file is known to be benign because the stored data comprises file reputation data that indicates the file was previously determined to have a good reputation.

12. The system of claim 7 , wherein determining the result the security program would report for the analysis of the file comprises retrieving, from a database of results of file analyses by the security program, a result of a previous analysis of the file.

13. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify a security program configured to analyze files on a client device to detect malicious files;

determine a result the security program would report for an analysis of a file on the client device, wherein determining the result the security program would report comprises submitting the file for analysis by the security program;

intercept an attempt by the security program to analyze the file; and

determine, based on the result the security program would report for the analysis of the file and based on stored data indicating whether the file is known to be benign, whether to permit the security program to analyze the file, wherein a file that is known to be benign is not malicious;

wherein, based on the result the security program would report is that the file is malicious, and based on the stored data indicating that the file is known to be benign, the security program is not permitted to analyze the file to prevent a false positive identification of the file as being malicious.

14. The non-transitory computer-readable medium of claim 13 , wherein the one or more computer-readable instructions cause the computing device to determine that the file is known to be benign because the stored data comprises file analysis results and file metadata that indicate the file has not been modified since a previous security analysis determined that the file is benign.

15. The non-transitory computer-readable medium of claim 13 , wherein the one or more computer-readable instructions cause the computing device to determine that the file is known to be benign because the stored data comprises file metadata that indicates the file has a benign file type.