Patent Description:
Computing devices - smartphones, computers, tablets, and so on - have become an essential attribute of almost every person's daily experience. With the help of such devices, people perform a multitude of everyday tasks: from exchanging emails to paying for purchases in stores. The widespread use of such devices motivates criminals to create malicious programs, especially those designed for unlawful access to user data, and also to the resources of the computing device as a whole.

At present, antivirus applications are widely used in the fight against malicious programs. The antivirus applications are programs designed to detect malicious programs and protect computing devices against those malicious programs. Various approaches and technologies are used to provide such protection: signature analysis, behavioral analysis, heuristic rules, and so forth. Yet as the antivirus technologies develop, criminals are also improving the ways of getting around these defense mechanisms. Thus, the development of antivirus technologies is always an urgent task, the goal of which is to enhance the quality of detection of malicious programs - to reduce the errors of the first and second kind in the detection of malicious programs.

<CIT> describes a system for evaluating a target file using similarity digests and locality sensitive hashes of legitimate files. <CIT>describes techniques for identifying malicious downloadable applications using locality sensitive hashes.

To enhance the aualitv of detection of malicious programs, classifying models obtained as a result of machine learning are being used increasingly and often. Such models identify all possible attributes (information about the compilers used in creating the applications, information about the sizes of the executable files, sets of machine instructions, and so on) from the applications being analyzed, especially the executable files (such as PE files), and on the basis of these tags assign the application being analyzed to one of the classes of applications; accordingly, the detection of a malicious application is carried out by assigning the analyzed application to the class of malicious applications. However, classification algorithms that may not be bad at detecting malicious applications may still need improvement in other characteristics. For example, the number of false positives (or other metrics that are based on the number of false positives) of an algorithm are important characteristics of the detection algorithm. Current classification algorithms generally rely on a serial process in which the detection algorithm is first designed, then applied, and at a later time improved based on a further analysis. This approach has its shortcomings. The number of false positives may remain too high for an extended length of time.

Hence, there is a need to create a solution which could eliminate these shortcomings and improve the quality of detection of malicious programs.

Aspects of the disclosure relate to the field of computer security, more specifically to systems and methods for reducing false positives in classification of files. The method of the present disclosure overcomes the shortcomings of the existing approaches by performing the detection of malicious files and the reduction of false positives simultaneously - thereby improving the quality of detection of malicious programs.

In one example, a method is implemented in a computer comprising a hardware processor, the method comprising: analyzing a file to determine whether or not the file is to be recognized as being malicious, when the file is recognized as being malicious, analyzing the file to detect a false positive outcome, when the false positive outcome is detected, excluding the file from being scanned and calculating a flexible hash of the file, and storing the calculated flexible hash in a database of exceptions.

According to one aspect of the disclosure, a system is provided for reducing false positives in classification of files, the system comprising a hardware processor configured to: analyze a file to determine whether or not the file is to be recognized as being malicious, when the file is recognized as being malicious, analyze the file to detect a false positive outcome, when the false positive outcome is detected, exclude the file from being scanned and calculate a flexible hash of the file, and store the calculated flexible hash in a database of exceptions.

In one aspect, the determination of whether or not files are malicious is performed on a predetermined number of unique files using a single record that includes at least the calculated flexible hash.

In one aspect, the false positive outcome is detected when an identifier of the file matches an identifier of a trusted file.

In one example, the detection of the false positive outcome for the file comprises: determining that a digital signature certificate is present for the file, comparing the certificate of the file with certificates of trusted files in a database, and detecting the false positive when a valid certificate with which the file is signed is present in the database.

In one example, the method further comprises: recognizing the file excluded from being scanned as being trusted.

In one example, the method further comprises: identifying other files having a flexible hash that matches the flexible hash of the file for which the false positive is detected, and recognizing the identified other files as being trusted.

In one example, the method further comprises: storing files recognized as being trusted in a database accessible by any number of computing systems.

The classification of files in accordance with the teachings of the present disclosure allows for detection of malicious files while simultaneously reducing the number of false positives - thereby providing an improvement in computer security.

Exemplary aspects are described herein in the context of a system, method, and a computer program for reducing false positives in classification of files. Those of ordinary skill in the art will realize that the following description is illustrative only and is not intended to be in any way limiting. Other aspects will readily suggest themselves to those skilled in the art having the benefit of the disclosure. Reference will now be made in detail to implementations of the example aspects as illustrated in the accompanying drawings. The same reference indicators will be used to the extent possible throughout the drawings and the following description to refer to the same or like items.

As an introduction, a number of definitions and concepts that are used in describing aspects of the disclosure are provided below.

A malicious application is an application able to cause harm to a computing device or to the data of the user of the computing device (in other words, a computer system: personal computer, server, mobile telephone, and so on), such as: an Internet worm, a keylogger, a computer virus. The harm caused may be unlawful access to the resources of the computer, including the data being kept on the computer, for the purpose of theft, as well as unlawful use of the resources, including for storage of data, performing computations, and so on.

A trusted application is an application which does not cause harm to a computer or to the user thereof. A trusted application can include an application which has been developed by a trusted software manufacturer, downloaded from a trusted source (such as a site listed in a database of trusted sites), or an application the identifier (or other data which can be used to uniquely identify the application) of which (such as the hash sum of the application file) is kept in a database of trusted applications. The identifier of the manufacturer, such as a digital certificate, may also be kept in the database of trusted applications.

An untrusted application is an application which is not trusted, but also not recognized as malicious, for example, with the aid of an antivirus application. Furthermore, an untrusted application may afterwards be recognized as malicious, for example, with the aid of an antivirus scan.

A malicious file is a file which is a component of a malicious application and which contains program code (executable or interpretable code).

An untrusted file is a file which is a component of an untrusted application and which contains program code (executable or interpretable code).

A trusted file is a file which is a component of a trusted application.

The predetermined application categories are at least the category of trusted applications, the category of untrusted applications, and the category of malicious applications.

A flexible hash ("similarity preserving hash"[<NUM>], especially a "locality sensitive hash"[<NUM>]) is a file hash calculated on the basis of data stored in a file, and the value of which will remain unchanged upon partial changing of that data.

In one example, the calculation of a flexible hash additionally makes use of data obtained by processing data stored in the file. For example, the data used to calculate the flexible hash may include records of function calls obtained from the execution log of the file. The execution log of the file may be populated and/or obtained by any standard method, during either the execution of the file or an emulation of the execution of the file. In one example, the flexible hash may be obtained in a form of a vector of values.

In one example, a flexible hash is a hash which will have an identical value for two similar files (the values of the flexible hashes calculated on the basis of the attributes of the files match up). The flexible hash of a group of files (a flexible hash corresponding to a group of files) includes a flexible hash, the value of which is the same for each file of that group. Files with a matching value of the flexible hash, especially the files from such a group, may be considered similar with a certain accuracy (accuracy in the present context can be taken to include a mean or a root mean square value of a degree of similarity, for example between every two files of that group), which is determined by the accuracy of the method for computing the flexible hash itself.

We shall consider two files to be similar if the degree of similarity between them is greater than a previously established threshold (for example, greater than <NUM>%, in other words greater than <NUM>). The degree of similarity may be computed with the aid of any known method, such as those based on calculating the: Jacquard, Dyce, Levenshtein, Hemming, and other measures.

False positive refers to a statistical term in which a true null hypothesis is rejected. That is, false positive refers to Type I errors. For example, the null hypothesis may be a hypothesis that states given files are not malicious. Suppose, the given files are actually not malicious. Then, if the files are erroneously recognized as being malicious, the "true" null hypothesis is rejected and a false positive event occurs.

It is noted that the system for reducing false positives in classification of files described in the present invention comprises actual devices, systems, components, and groups of components, realized with the use of hardware such as integrated microcircuits (application-specific integrated circuit, ASIC) or a field-programmable gate array (FPGA) or, for example, in the form of a combination of software and hardware such as a microprocessor system and a set of program instructions, and also based on neurosynaptic chips. The functionality of the system of the present disclosure may be realized exclusively by hardware, and also in the form of a combination, where some of the functionality of the system is realized by software and some by hardware. In certain examples, some or all of the operations of the system can be implemented on a processor of a general-purpose computer (such as the one depicted in <FIG>). Furthermore, the components of the system may be realized within a single computing device or distributed among several interconnected computing devices.

<FIG> is a block diagram illustrating an exemplary system <NUM> for reducing false positives in classification of files in accordance with aspects of the present disclosure. The present system includes the following: a malicious files detector <NUM>, an evaluator <NUM>, a false positives corrector <NUM>, and a database of exceptions <NUM>. In one example, the system <NUM> further comprises a database of trusted files <NUM>.

In one example, all the components of the system are situated on the computing device of the user or client (such as the personal computer of a user). In another example, all the components of the system are situated on a remote server. In yet another example, the malicious files detector <NUM> and the database of exceptions <NUM> are situated on the computing device of the user, while the evaluator <NUM> and the false positives corrector <NUM> are situated on the server device. In yet another example, the malicious files detector <NUM>, the database of exceptions <NUM> and the evaluator <NUM> are situated on the computing device of the client, while the false positives corrector <NUM> is situated on the server device. In yet another example, the evaluator <NUM> is situated on the server device, while the other components of the system are situated on the computing device of the client. In yet another example, all of the components of the system (i.e., the malicious files detector <NUM>, the evaluator <NUM>, the false positives corrector <NUM>, and the database of exceptions <NUM>) are situated on a remote server, while a proxy agent is situated on the computing device of the client, wherein the proxy agent is used to transmit, to the remote server, all the data needed for the operations of the malicious files detector <NUM>, the evaluator <NUM>, the false positives corrector <NUM>, and the database of exceptions <NUM>.

In one example, the malicious files detector <NUM> is designed to detect malicious files. It should be noted that malicious files are a particular instance of the category of files having the common characteristic that the files of this category may inflict harm on a computing device or the user of the computing device. It is noted that the method and system of the present disclosure may be used for malicious files, or files of any other category. In other words, "malicious files" may be one such category. In one example, the category is a category of undesirable files, such as those related to undesirable software, advertising software (adware), software altering the settings of other applications (e.g., altering the start page of a browser).

For ease of understanding, the method of the present disclosure is described below by way of an exemplary category that is established for malicious files. For clarity, files that do not belong to this established category of malicious files are referred to as "trusted files. " Accordingly, for the exemplary category, the term "false positive" applies when a file is falsely recognized as belonging to the established category of malicious files when the file is not malicious, i.e., the file is trustworthy and thus should be recognized as being a trusted file. In other words, a false positive refers to wrongly recognizing the file as belonging to a certain category (in particular, the class of malicious files), when the file does not belong to that category (in particular, the file belongs to the category of trusted files).

The detecting of a malicious file comprises: analyzing, by the malicious files detector <NUM>, the file, and recognizing the file as being malicious. In one example, for recognizing the files as being malicious, the malicious files detector <NUM> employs any method ordinarily known by those skilled in the art of data security. In one example, in order to identify a file as malicious, the malicious files detector <NUM> may employ any method ordinarily known by those skilled in the art of data security. However, regardless of the method used to recognize the file as being malicious, the correction of a false positive outcome of the method is a labor-intensive operation; In particular:.

In one example, the amount of time spent correcting the false positive outcome is considered significant when the duration of time spent for the correction of the false positive outcome is greater than an established threshold value for a duration of time, such as <NUM> hour or more. In one example, the volume of data sent for the correction of the false positive outcome is considered significant when the volume of data (sent) is greater than an established threshold value for volume of data, such as <NUM> Megabyte or more.

In one example, the malicious files detector <NUM> performs the detection on a predetermined number of unique files using a single record (such as a heuristic rule, a flexible hash, and so forth). In other words, the present disclosure has a generalization ability when used for detection of malicious files.

In one example, the malicious files detector <NUM> uses a classifying algorithm for the detecting of the malicious files. The corresponding correction of the false positive outcome (i.e., the correction to reclassify the files which were previously misclassified as being malicious) requires a significant amount of time. The correction includes re-teaching the classification algorithm. Moreover, the re-teaching is not just for one type of file. Rather, the re-teaching includes supporting the generalization ability.

In one example, the classification algorithm of the present disclosure includes:.

It is noted that the teaching and re-teaching of any of the classification algorithms of the present disclosure may be performed using any method ordinarily known in the art of data structures. Thus, the particular teachings and re-teaching techniques are not described in the present disclosure.

Returning to <FIG>, the malicious files detector <NUM> may employ a classification algorithm for scanning files and determining whether or not each scanned file is malicious. For example, a group of files <NUM> is shown in <FIG>. The group of files <NUM> includes files for which the malicious files detector <NUM> is to perform the scanning for the purpose of detecting whether or not the files in the group are malicious. For example, a file <NUM> of <FIG> is one exemplary file of the group of files <NUM> for which the malicious files detector <NUM> may employ the classification algorithm to scan and ascertain whether or not the file is malicious.

In one example, the group of files <NUM> may comprise files on the computing device of the user. In another example, the group of files <NUM> may comprise files on a remote server. Thus, the malicious files detector <NUM> scans the file <NUM>; upon completion of the scan, the malicious files detector <NUM> recognizes the file <NUM> either as a malicious file or a non-malicious file. If the file <NUM> is recognized as being malicious, the malicious files detector <NUM> sends the file <NUM> recognized as being malicious (or all necessary information about the file) to the evaluator <NUM>.

Then, the evaluator <NUM> receives and analyzes the file <NUM> (or the information about the file <NUM>). The purpose of the analysis is to detect a false positive outcome of the malicious files detector <NUM>, the false positive outcome being an outcome in recognizing the file <NUM> as being malicious. In other words, the analysis by the evaluator <NUM> reveals whether or not the malicious files detector <NUM> erroneously recognized the file <NUM> as being malicious.

In one example, the evaluator <NUM> uses any approach ordinarily known in the art for detecting a false positive outcome. For example, the evaluator <NUM> may compare the identifier of the file <NUM> with identifiers of trusted files. In one example, the identifier of the file <NUM> may comprise a check sum of the file <NUM> (MD5 or SHA-<NUM>, and others).

In one example, the identifiers of the trusted files are stored in a database of trusted files <NUM>. In one example, the database <NUM> is situated within the confines of the computing device on which the evaluator <NUM> is situated. In another example, the database <NUM> and the evaluator <NUM> are on different computing devices - thereby being considered as remotely situated with respect to each other.

In one example, the evaluator <NUM> detects a false positive outcome when the evaluator <NUM> determines that an identifier of the file <NUM> is present in a database of trusted files <NUM>. For example, the malicious files detector <NUM> detects a given file <NUM> as being malicious. However, subsequently, the evaluator <NUM> locates the identifier of the given file <NUM> in a database of trusted files - thus signifying that the file <NUM> is erroneously identified as being malicious. In other words, when a trusted file is identified as being malicious, the evaluator <NUM> detects a false positive outcome. Similarly, the evaluator <NUM> does not detect a false positive outcome when the evaluator <NUM> determines that the identifier of the file <NUM> is not present in the database of trusted files <NUM>.

In one example, when a digital signature certificate is present for the file <NUM>, the evaluator <NUM> compares the certificate of the file <NUM> with certificates kept in the database of trusted files <NUM>. The evaluator <NUM> detects a false positive when the certificate with which the file <NUM> is signed is present in the database <NUM>, and the certificate is valid. Otherwise, the evaluator <NUM> does not detect a false positive outcome in the file <NUM> being recognized as being malicious.

In one example, the data kept in the database of trusted files <NUM> may be modified, e.g., by persons with expertise in the field of IT security. In one example, the modification may be performed via a remote link. In another example, the modification may be performed by a local expert.

In one example, when the false positive is detected for a file <NUM> by the evaluator <NUM>, the evaluator <NUM> sends the file <NUM> for which the false positive is detected to a false positives corrector <NUM>.

In one example, the false positives corrector <NUM> calculates a flexible hash <NUM> of the file received from the evaluator <NUM>, and sends the calculated flexible hash <NUM> to a database of exceptions <NUM>, as illustrated in <FIG>. For example, when the file <NUM> is wrongly recognized as being malicious by the malicious files detector <NUM>, the evaluator <NUM> may subsequently detect a false positive and send the file to the false positives corrector <NUM>. The false positives corrector <NUM> may then compute and store the flexible hash of the file <NUM> in the database of exceptions <NUM>.

In turn, the flexible hashes <NUM>, kept in the database of exceptions <NUM>, may be used by the malicious files detector <NUM> when performing the scanning of files. Thus, the malicious files detector <NUM>, receives files earmarked to be scanned, for e.g., any file of the group of files <NUM>. Then, the malicious files detector <NUM> first determines whether or not files earmarked to be scanned are present in the database of exceptions <NUM>. The database of exceptions <NUM> is populated by the false positives corrector <NUM> by computing flexible hashes <NUM> and storing in the database of exceptions <NUM>. Then, when a flexible hash of a file earmarked to be scanned is present in the database of exceptions, the file is excluded from the scanning.

In one example, a file earmarked for scanning is subsequently excluded from being scanned when the flexible hash of the file is in a form of a vector of values [x<NUM>, x<NUM>, x<NUM>. ], a flexible hash [y<NUM>, y<NUM>, y<NUM>. ] is found in the database of exceptions, and indices of elements of an I vector are indicated such that at least one of the following conditions is satisfied:.

In one example, the file that is excluded from being scanned is recognized as trusted.

Thus, as described above, malicious files detector <NUM> is able to calculate the flexible hash of the file <NUM>, as well as compare the calculated flexible hash with the hashes kept in the database of exceptions <NUM> (for example, by comparing the values of the hashes). Moreover, during the repeat scanning of the file <NUM> by the malicious files detector <NUM>, the file <NUM> will not be recognized as being malicious. The repeat scanning is performed whenever the malicious files detector <NUM> is being used.

Returning to <FIG>, a group of files is schematically designated by a vicinity of the file <NUM> - the region <NUM>, symbolizing a group of files similar to file <NUM> which are wrongly recognized as being malicious, wherein all of the files in the region <NUM> are files from among the group of files <NUM>. Thus, the malicious files detector <NUM> may perform scanning for the group of files <NUM>, and files in region <NUM> may be files intended to be scanned but having flexible hashes present in the database of exceptions <NUM>. Then, when a false positive outcome of the malicious files detector <NUM> is identified, all files in region <NUM> are successfully excluded from the scanning, e.g., the files that match with the flexible hash <NUM> of the file <NUM> are excluded from the scanning.

The approach described above enables the system <NUM> to reduce a number of false positives. For the example described above, changes are made to the algorithm of the malicious files detector <NUM> such that files previously recognized as being malicious and then subsequently found as being non-malicious are used to improve the algorithm itself. In other words, when (<NUM>) a file <NUM> is initially identified as being malicious by the malicious files detector, (<NUM>) a false positive is detected for the file <NUM> by the evaluator <NUM>, (<NUM>) a flexible hash <NUM> is computed by the false positive corrector <NUM>, and (<NUM>) the computed flexible hash of the file <NUM> is stored in the database of exceptions <NUM>, the algorithm of the malicious files detector <NUM> is improved such that files similar to the file <NUM> are not recognized as being malicious - thereby reducing subsequent false positives. The use of the flexible hash <NUM> for excluding files from the scanning, by the malicious files detector <NUM>, enables the method of the present disclosure to avoid repeat false positive outcomes with respect to the same file <NUM> for which the flexible hash <NUM> was computed. In addition, false positive outcomes with respect to files in region <NUM>, which are files similar to file <NUM>. Note that the malicious files detector <NUM> may not have performed any scans on the files in region <NUM>. However, the malicious files detector <NUM> may avoid scanning the files in region <NUM> based on the knowledge gained from the flexible hash <NUM>.

In one example, the false positive outcomes with respect to files in region <NUM> are avoided by recognizing the files in region <NUM> as being trusted files when the flexible hash <NUM> is stored in database of exceptions <NUM>.

As described above, the method of the present disclosure reduces the number of false positives. Moreover, the method supports generalizing the improvements in the classification algorithms such that false positives may be eliminated for files even before the files are scanned. For the example of <FIG>, false positive outcomes may be eliminates for files in region <NUM> based on knowledge gained from scanning only file <NUM>.

The method of the present disclosure reduces the false positives without requiring a large amount of data to be sent through a network. As such, unlike other method that require either a large amount of data to be sent via the network or a significant amount of time to be spent analyzing each outcome and re-teaching the classifier, the method of the present disclosure reduces the number of false positives while addressing the shortcomings. The method of the present disclosure advantageously corrects the false positives for subsequent scans without requiring a re-teaching of the classifying algorithm.

<FIG> is a flow diagram of an exemplary method <NUM> for reducing false positives in classification of files in accordance with aspects of the present disclosure. The method of <FIG> may be carried out with the aid of the classification system described in conjunction with <FIG>.

In step <NUM>, the malicious files detector <NUM> analyzes the file <NUM> to determine whether or not the file <NUM> should be recognized as being malicious.

In step <NUM>, when the file <NUM> is recognized as being malicious, the evaluator <NUM> analyzes the file <NUM> (i.e., performs a repeat analysis) to detect a false positive outcome. In other words, the evaluator <NUM> determines whether or not the malicious files detector <NUM> erroneously classified the file <NUM> as being malicious. When the evaluator <NUM> detects a false positive, the method proceeds to step <NUM>. Otherwise, the method proceeds to step <NUM>.

In step <NUM>, method <NUM> keeps the recognition of the file <NUM> as malicious. For example, the decision to recognize the file as being malicious is not changed. The method then proceeds to step <NUM>.

In step <NUM>, method <NUM>, by the false positives corrector <NUM>, excluding the file from being scanned and calculates a flexible hash of the file <NUM>. For example, the flexible hash <NUM> of the file <NUM> which was wrongly recognized as being malicious is computed by the false positives corrector <NUM>. The exclusion of the file from being scanned may be performed by recognizing the file as being non-malicious.

Various methods exist for calculating the flexible hash such that the value of this hash coincides for two similar files, such as locality sensitive hashing (LSH), as well as other hash functions formed with the help of supervised learning or partial supervised learning contingent upon satisfying the "similarity preserving" condition - the stability of the hash value against a change in the data used to calculate the hash. Files are considered similar when the computed hashes match.

In one example, the false positives corrector <NUM> is trained via a training module. For example, the training module may gather data from various computing devices. Then, based on initial malicious file designations and subsequent corrections, the training algorithm may be improved such that the false positive corrector <NUM> is better equipped to identify instances of false positive outcomes of the malicious files detector <NUM>.

In step <NUM>, method <NUM>, stores the calculated flexible hash in a database of exceptions. For example, the flexible hash computed in step <NUM> is added to the database of exceptions <NUM>.

In one example, the adding of the flexible hash <NUM> to the database of exceptions <NUM> is performed by the false positives corrector <NUM>. In another example, the flexible hashes computed by the false positives corrector <NUM> are sent to a data security expert. For example, a computing device of the data security expert may gather the flexible hashes. The expert may then analyze the gathered flexible hashes and decide which ones should be added to the database of exceptions <NUM>. In one example, the expert may also update rules associated with the file classification algorithms used by the malicious files detector <NUM>.

In step <NUM>, method <NUM> analyzes other files using the flexible hash to determine whether or not the files should be excluded from being scanned. Files with flexible hash present in the database are excluded. It is noted that the other files may or may not have been previously scanned. Thus, if the flexible hash of some of the files in queue to be scanned, by the malicious files detector <NUM>, are now found in the database of exceptions <NUM>, the scanning is avoided - thereby reducing the number of files to be scanned. For the example of <FIG>, the flexible hashes of files <NUM> may be present in the database of exceptions <NUM>. Thus, files <NUM> may be excluded from further analysis by the malicious files detector <NUM>.

In one example, the determination of whether or not files are malicious is performed on a predetermined number of unique files using a single record that includes at least the calculated flexible hash.

In one example, the false positive outcome is detected when an identifier of the file matches an identifier of a trusted file.

In one example, the method further comprises: recognizing the file excluded from being scanned as being trusted. In one example, the method further comprises: identifying other files having a flexible hash that matches the flexible hash of the file for which the false positive is detected, and recognizing the identified other files as being trusted.

In one example, the method further comprises: storing files recognized as being trusted in a database accessible by any number of computing systems. In one example, files recognized as being trusted are stored in a database (e.g., either in the database of exceptions <NUM> or some other database). For instance, multiple computing systems of an enterprise may share the list so as to reduce duplicative work.

The method of the present disclosure has advantages over classifiers that have a large number of false positives. Unlike other systems that rely on a serial process to design a detection algorithm, apply the designed algorithm, then analyze the result of the design being applied to improve the algorithm, the method of the present disclosure reduces the false positives as the algorithm is being applied. The present disclosure reduces the number of false positives without an extensive delay. Thus, the use of the present method makes possible: achieving the technical result of increasing the quality of categorization of files by decreasing the number of false positives when detecting malicious files.

<FIG> is a block diagram illustrating a computer system <NUM> on which aspects of systems and methods for reducing false positives may be implemented. It should be noted that the computer system <NUM> can correspond to a device with an interceptor, for example, as described earlier. The computer system <NUM> can be in the form of multiple computing devices, or in the form of a single computing device, for example, a desktop computer, a notebook computer, a laptop computer, a mobile computing device, a smart phone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.

As shown, the computer system <NUM> includes a central processing unit (CPU) <NUM>, a system memory <NUM>, and a system bus <NUM> connecting the various system components, including the memory associated with the central processing unit <NUM>. The system bus <NUM> may comprise a bus memory or bus memory controller, a peripheral bus, and a local bus that is able to interact with any other bus architecture. Examples of the buses may include PCI, ISA, PCI-Express, HyperTransport™, InfiniBand™, Serial ATA, I<NUM>C, and other suitable interconnects. The central processing unit <NUM> (also referred to as a processor) can include a single or multiple sets of processors having single or multiple cores. The processor <NUM> may execute one or more computer-executable code implementing the techniques of the present disclosure. The system memory <NUM> may be any memory for storing data used herein and/or computer programs that are executable by the processor <NUM>. The system memory <NUM> may include volatile memory such as a random access memory (RAM) <NUM> and non-volatile memory such as a read only memory (ROM) <NUM>, flash memory, etc., or any combination thereof. The basic input/output system (BIOS) <NUM> may store the basic procedures for transfer of information between elements of the computer system <NUM>, such as those at the time of loading the operating system with the use of the ROM <NUM>.

Computer readable program instructions for carrying out operations of the present disclosure may be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language, and conventional procedural programming languages. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a LAN or WAN, or the connection may be made to an external computer (for example, through the Internet). In some aspects of the present disclosure, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

In various examples, the systems and methods described in the present disclosure can be addressed in terms of modules. The term "module" as used herein refers to a real-world device, component, or arrangement of components implemented using hardware, such as by an application specific integrated circuit (ASIC) or FPGA, for example, or as a combination of hardware and software, such as by a microprocessor system and a set of instructions to implement the module's functionality, which (while being executed) transform the microprocessor system into a special-purpose device. A module may also be implemented as a combination of the two, with certain functions facilitated by hardware alone, and other functions facilitated by a combination of hardware and software. In certain implementations, at least a portion, and in some cases, all, of a module may be executed on the processor of a computer system (such as the one described in greater detail in <FIG>, above). Accordingly, each module may be realized in a variety of suitable configurations, and should not be limited to any particular implementation exemplified herein.

Furthermore, it is to be understood that the phraseology or terminology used herein is for the purpose of description and not of restriction, such that the terminology or phraseology of the present specification is to be interpreted by the skilled in the art in light of the teachings and guidance presented herein, in combination with the knowledge of those skilled in the relevant art(s). Moreover, it is not intended for any term in the specification or claims to be ascribed an uncommon or special meaning unless explicitly set forth as such.

Claim 1:
A computer implemented method (<NUM>) for reducing a number of false positives in classification of files, the method comprising:
analyzing (<NUM>) a file to determine whether or not the file is to be recognized as being malicious;
when the file is recognized as being malicious, analyzing (<NUM>) the file to detect a false positive outcome by:
determining that a digital signature certificate is present for the file, comparing the certificate of the file with certificates of trusted files in a database of trusted files; and
detecting the false positive when a valid certificate with which the file is signed is present in the database of trusted files;
when the false positive outcome is detected, excluding (<NUM>) the file from further determination of whether the file is malicious and calculating a flexible hash (<NUM>) of the file;
storing (<NUM>) the calculated flexible hash in a database of exceptions (<NUM>); and
determining whether or not other files different from the analyzed file are malicious, wherein the determination of whether or not the other files are malicious is performed on a predetermined number of unique files using a single record that includes at least the calculated flexible hash (<NUM>).