Reducing false positive rate of statistical malware detection systems

A method to decrease the false positive rate of cloud based heuristic malware analysis and detection processes, the method comprising the steps of:

• introducing context aware classifiers using available contextual information collected from a client computer without any manual intervention, said contextual information stored in an information database which maintains relations between said contextual information and binary files;
• sending said context aware classifiers to cloud for analysis;
• training new machine learning models for malware detection based on individual contextual information for each new context aware machine learning model;
• using newly developed machine learning model on each file where an initial heuristic malware analysis predicts a sample as malware and said sample has identical contextual information as said newly developed context aware machine learning model;
• marking said initial heuristic malware analysis as false alarm if file was classified as clean during use with said newly developed machine learning model and updating final decision as clean;
• and
• continuing with the result of said initial heuristic malware analysis if said file was classified as malware during use with said newly developed machine learning model;
• detecting unknown file named uninstall.exe at said client computer;
• sending said unknown file to cloud for analysis;
• implementing feature extraction for machine learning;
• sending features from said feature extraction to said newly developed machine learning model;
• labelling, by a first static analysis, said unknown file as malware;
• checking, by previously trained context aware classifier, if there is matching contextual information;
• detecting, by context aware machine learning model, that said unknown file name includes ‘uninstall’ term;
• re-classifying said unknown file as a malware file or classifying said unknown file as a clean file.