Patent ID: 8925088

Claim:
A method for using one or more computer processors to provide false positive reduction for heuristic-based malware detection of a plurality of files in a computer readable memory, comprising: receiving at least one local first appearance date associated with each file of a plurality of files; accessing global first appearance information associated with each of the plurality of files, wherein the global first appearance information comprises a global first appearance date of each file of the plurality of files, and wherein the global first appearance date of each file of the plurality of files is an earliest received local first appearance date associated with each of the plurality of files; accessing global malware information comprising heuristics and an emergence date associated with each malware group of a plurality of malware groups; comparing, using at least one computer processor, the global malware information with the global first appearance information; and identifying at least one false positive amongst the plurality of files, wherein the global first appearance date of the at least one false positive predates the emergence date associated with the each malware group of the plurality of malware groups.