System and method of reducing a number of false positives in classification of files
Disclosed herein are systems and methods for reducing a number of false positives in classification of files. In one aspect, an exemplary method comprises, analyzing a file to determine whether or not the file is to be recognized as being malicious, when the file is recognized as being malicious, analyzing the file to detect a false positive outcome, when the false positive outcome is detected, excluding the file from being scanned and calculating a flexible hash of the file, and storing the calculated flexible hash in a database of exceptions.
1. A method for reducing a number of false positives in classification of files, the method comprising:
analyzing a file to determine whether or not the file is to be recognized as being malicious;
when the file is recognized as being malicious, analyzing the file to detect a false positive outcome;
when the false positive outcome is detected, excluding the file from further determination of whether the file is malicious and calculating a flexible hash of the file;
storing the calculated flexible hash in a database of exceptions; and
determining whether or not other files different from the analyzed file are malicious, wherein the determination of whether or not the other files are malicious is performed on a predetermined number of unique files using a single record that includes at least the calculated flexible hash.
2. The method of claim 1 , wherein the false positive outcome is detected when an identifier of the file matches an identifier of a trusted file.
3. The method of claim 1 , wherein the detection of the false positive outcome for the file comprises:
determining that a digital signature certificate is present for the file, comparing the certificate of the file with certificates of trusted files in a database of trusted files; and
detecting the false positive when a valid certificate with which the file is signed is present in the database of trusted files.
4. The method of claim 1 , further comprising:
recognizing the file excluded from being scanned as being trusted.
5. The method of claim 1 , further comprising:
identifying other files having a flexible hash that matches the flexible hash of the file for which the false positive is detected; and
recognizing the identified other files as being trusted.
6. The method of claim 1 , further comprising:
storing files recognized as being trusted in a database of trusted files accessible by any number of computing systems.
7. A system for reducing a number of false positives in classification of files, comprising:
at least one hardware processor configured to:
analyze a file to determine whether or not the file is to be recognized as being malicious;
when the file is recognized as being malicious, analyze the file to detect a false positive outcome;
when the false positive outcome is detected, exclude the file from further determination of whether the file is malicious and calculate a flexible hash of the file; and
store the calculated flexible hash in a database of exceptions; and
determine whether or not other files different from the analyzed file are malicious, wherein the determination of whether or not the other files are malicious is performed on a predetermined number of unique files using a single record that includes at least the calculated flexible hash.
8. The system of claim 7 , wherein the false positive outcome is detected when an identifier of the file matches an identifier of a trusted file.
9. The system of claim 7 , the configuration for the detection of the false positives outcomes comprises configuration for:
determining that a digital signature certificate is present for the file, comparing the certificate of the file with certificates of trusted files in a database of trusted files; and
detecting the false positive when a valid certificate with which the file is signed is present in the database of trusted files.
10. The system of claim 7 , wherein the processor is further configured to:
recognize the file excluded from being scanned as being trusted.
11. The system of claim 7 , wherein the processor is further configured to:
identify other files having a flexible hash that matches the flexible hash of the file for which the false positive is detected; and
recognize the identified other files as being trusted.
12. The system of claim 7 , wherein the processor is further configured to:
store files recognized as being trusted in a database of trusted files accessible by any number of computing systems.
13. A non-transitory computer readable medium storing thereon computer executable instructions for reducing a number of false positives in classification of files, including instructions for:
analyzing a file to determine whether or not the file is to be recognized as being malicious;
when the file is recognized as being malicious, analyzing the file to detect a false positive outcome;
when the false positive outcome is detected, excluding the file from further determination of whether the file is malicious and calculating a flexible hash of the file;
storing the calculated flexible hash in a database of exceptions; and
determining whether or not other files different from the analyzed file are malicious, wherein the determination of whether or not the other files are malicious is performed on a predetermined number of unique files using a single record that includes at least the calculated flexible hash.
14. The non-transitory computer readable medium of claim 13 , wherein the false positive outcome is detected when an identifier of the file matches an identifier of a trusted file.
15. The non-transitory computer readable medium of claim 13 , the instructions for detection of the false positive outcome for the file include instructions for:
determining that a digital signature certificate is present for the file, comparing the certificate of the file with certificates of trusted files in a database of trusted files; and
detecting the false positive when a valid certificate with which the file is signed is present in the database of trusted files.
16. The non-transitory computer readable medium of claim 13 , wherein the instructions further include instructions for:
recognizing the file excluded from being scanned as being trusted.
17. The non-transitory computer readable medium of claim 13 , wherein the instructions further include instructions for:
identifying other files having a flexible hash that matches the flexible hash of the file for which the false positive is detected; and
recognizing the identified other files as being trusted.
18. The non-transitory computer readable medium of claim 13 , wherein the instructions further include instructions for:
storing files recognized as being trusted in a database of trusted files accessible by any number of computing systems.