Patent ID: 8561180

Claim:
A computer-implemented method for aiding in the detection of false positives generated by security systems, at least a portion of the method being performed by a centralized computer system comprising at least one processor, the method comprising: building a registered-files database for a group of centrally managed computers by: receiving, from the group of centrally managed computers, a unique identifier for each file within the group of centrally managed computers that will be scanned by a security component that is to be deployed within the group of centrally managed computers; determining, based on the unique identifiers, that the registered-files database does not contain a full copy of at least one file that will be scanned by the security component; requesting a full copy of the file from at least one client within the group of centrally managed computers; receiving the full copy of the file from the client; storing the full copy of the file in the registered-files database such that the registered-files database contains: a full copy of each file within the group of centrally managed computers that will be scanned by the security component; metadata that is relevant to evaluating whether any of the files that will be scanned comprise malware; prior to deploying the security component to the group of centrally managed computers for the first time, determining whether the security component would generate any false positives if deployed within the group of centrally managed computers by incorrectly classifying legitimate files as malicious by: applying the security component to the files contained within the registered-files database; presenting, to an administrator of the registered-files database, both a list of each file within the registered-files database that the security component classified as malicious and metadata for each file on the list; upon presenting the list and the metadata to the administrator, receiving a user-generated response from the administrator that identifies at least one false positive generated by the security component; upon determining that the security component would generate the false positive if deployed within the group of centrally managed computers, performing at least one action that aids in the elimination of the false positive.