Patent Document ID: 10075454
Application ID: 14675443
Patent Status: 1

Claim One:
1. A computer implemented method for using telemetry data tracked over time concerning a plurality of samples convicted as comprising malware by different ones of a plurality of endpoint computers, to detect samples that were falsely convicted, the method comprising: tracking, by a central computer, telemetry data concerning the plurality of samples convicted as comprising malware by utilizing specific anti-malware technologies by different ones of the plurality of endpoint computers, wherein the tracking occurs over a fixed period of time during which a specific sample is convicted as comprising malware more than once by a single endpoint of the plurality of endpoint computers, the tracking further comprising identifying patterns indicative of a false positive conviction of the specific sample during the fixed period of time; analyzing tracked telemetry data concerning convicted samples, by the central computer, wherein the analyzed tracked telemetry data is indicative of whether convictions of specific ones of the samples comprise false positives, the analyzing further comprising computing one or more of: an average number of convictions of the specific sample over the fixed period of time; a standard deviation of a number of convictions of the specific sample over the fixed period of time; a time duration between a first conviction of the specific sample and a subsequent conviction of the specific sample during the fixed period of time; exonerating at least one conviction of at least one sample as comprising a false positive, by the central computer, based on results of analyzing of tracked telemetry data concerning the samples convicted as comprising malware; and updating an anti-malware system to account for the at least one exonerated conviction of the at least one sample as comprising a false positive, based on analyzed tracked telemetry data indicative of convictions of specific ones of the samples comprising false positives.