Apparatus, articles of manufacture, and methods for suppression of false positive malware detection

At least one non-transitory computer readable storage medium comprising instructions that, when executed, cause processor circuitry to at least:

• execute a machine-learning model based on a feature associated with an executable file to generate a malware detection output;
• after a first determination that the malware detection output identifies the executable file as malware, identify the malware detection output as a false positive malware detection output based on the feature associated with the executable file invoking false positive suppression rules, wherein the false positive suppression rules are generated based on an execution of a rulefit model trained on false positive detections of malware and non-false positive detections of malware, and wherein the false positive suppression rules include a first false positive suppression rule corresponding to a file size of the executable file and a second false positive suppression rule corresponding to a name of the executable file;
• and
• cause execution of the executable file based on the identification of the malware detection output as the false positive malware detection output.

A method comprising:

• executing, by executing an instruction with a processor, a machine-learning model based on a feature associated with an executable file to generate a malware detection output;
• after a first determination that the malware detection output identifies the executable file as malware, identifying, by executing an instruction with the processor, the malware detection output as a false positive malware detection output based on the feature invoking false positive suppression rules, wherein the false positive suppression rules are generated based on an execution of a rulefit model trained on false positive detections of malware and non-false positive detections of malware, and wherein the false positive suppression rules include a first false positive suppression rule corresponding to a file size of the executable file and a second false positive suppression rule corresponding to a name of the executable file;
• and
• executing, by executing an instruction with the processor, the executable file based on the identification of the malware detection output as the false positive malware detection output.

An apparatus comprising:

• means for executing a machine-learning model based on a feature associated with an executable file to generate a malware detection output;
• means for identifying, after a first determination that the malware detection output identifies the executable file as malware, the malware detection output as a false positive malware detection output based on the feature invoking false positive suppression rules, wherein the false positive suppression rules are generated based on an execution of a rulefit model trained on false positive detections of malware and non-false positive detections of malware, and wherein the false positive suppression rules include a first false positive suppression rule corresponding to a file size of the executable file and a second false positive suppression rule corresponding to a name of the executable file;
• and
• means for causing execution of the executable file based on the identification of the malware detection output as the false positive malware detection output.