Patent ID: 8719935

Claim:
A system for recognizing false positives in malware detection, comprising a server computer having at least one processor programmed to: receiving, at the server computer, at least one malware report identifying at least one suspicious version of a file on a host computer; upon receipt of identification of a suspicious version of a file, determining whether the suspicious version of the file is a false positive by: performing a first analysis to determine whether a likelihood of a false positive is low; upon determining the likelihood of a false positive is low, reporting a malware attack; and upon determining the likelihood of a false positive is not low, performing a second analysis to recognize a false positive by: obtaining first summary information associated with the suspicious version of the file, obtaining second summary information associated with a control version of the file, comparing the first and second summary information to determine whether the suspicious version of the file matches the control version of the file, and when it is determined that the suspicious version matches the control version, reporting a false positive.