# US 12,694,111 B2 · Apparatus, articles of manufacture, and methods for suppression of false positive malware detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,694,111 B2 - Document ID: US12694111B2 - Status: Granted - Kind: B2 - Application number: 18/068,298 - Filed: 2022-12-19 - Published: 2024-06-20 - Granted: 2026-07-28 - Earliest claimed: 2022-12-19 - Assignees: McAfee, Inc. - Applicants: McAfee, LLC - Inventors: Niall Fitzgerald - Web page: https://patentgrep.com/patent/US12694111B2 ## CPC - G06F 21/568: {eliminating virus, restoring damaged files} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods, apparatus, systems, and articles of manufacture are disclosed for suppression of false positive malware detection. An example apparatus includes at least one memory, machine-readable instructions, and processor circuitry to at least one of instantiate or execute the machine-readable instructions to execute a machine-learning model based on a feature associated with an executable file to generate a malware detection output. The processor circuitry is further to, identify, after a first determination that the malware detection output identifies the executable file as malware, the malware detection output as a false positive malware detection output based on the feature invoking a false positive suppression rule. Additionally, the processor circuitry is to cause execution of the executable file based on the identification of the malware detection. ## Claims ### Claim 1 An apparatus comprising: at least one memory; machine-readable instructions; and processor circuitry to at least one of instantiate or execute the machine-readable instructions to: execute a machine-learning model based on a feature associated with an executable file to generate a malware detection output; identify, after a first determination that the malware detection output identifies the executable file as malware, the malware detection output as a false positive malware detection output based on the feature associated with the executable file invoking false positive suppression rules, wherein the false positive suppression rules are generated based on an execution of a rulefit model trained on false positive detections of malware and non-false positive detections of malware, and wherein the false positive suppression rules include a first false positive suppression rule corresponding to a file size of the executable file and a second false positive suppression rule corresponding to a name of the executable file; and cause execution of the executable file based on the identification of the malware detection output as the false positive malware detection output. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the malware detection output is a first malware detection output, the feature associated with the executable file is a first feature associated with the executable file, and wherein the processor circuitry is to identify a second malware detection output as a true positive malware detection output based on a second feature associated with the executable file not invoking the false positive suppression rule. ### Claim 3 (depends on 2) The apparatus of claim 2, wherein the processor circuitry is to execute a malware protection operation based on the identification of the second malware detection output as the true positive malware detection output. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the malware protection operation is one of a quarantining of the executable file, a halting of the execution of the executable file, a prevention of the execution of the executable file, a deletion of the executable file, or a sandboxing of the executable file. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the executable file is a portable execution file included in a container file. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the feature is a signature, a type of machine on an endpoint device, a number of sections of a section table, or a size of a header of the executable file. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the feature associated with the executable file is a first feature associated with the executable file, the executable file is a first executable file, the malware detection output is a first malware detection output, and the processor circuitry is further to: identify second malware detection outputs associated with second executable files as false positive malware detection outputs; generate first data associations of the false positive malware detection outputs and second features of the second executable files; identify third malware detection outputs associated with third executable files as non-false positive malware detection outputs; generate second data associations of the non-false positive malware detection outputs and third features of the third executable files; and execute the rulefit model based on the first data associations and the second data associations to output the false positive suppression rule. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the processor circuitry is to cause transmission of the false positive suppression rules to an endpoint device. ### Claim 9 At least one non-transitory computer readable storage medium comprising instructions that, when executed, cause processor circuitry to at least: execute a machine-learning model based on a feature associated with an executable file to generate a malware detection output; after a first determination that the malware detection output identifies the executable file as malware, identify the malware detection output as a false positive malware detection output based on the feature associated with the executable file invoking false positive suppression rules, wherein the false positive suppression rules are generated based on an execution of a rulefit model trained on false positive detections of malware and non-false positive detections of malware, and wherein the false positive suppression rules include a first false positive suppression rule corresponding to a file size of the executable file and a second false positive suppression rule corresponding to a name of the executable file; and cause execution of the executable file based on the identification of the malware detection output as the false positive malware detection output. ### Claim 10 (depends on 9) The at least one non-transitory computer readable storage medium of claim 9, wherein the malware detection output is a first malware detection output, the feature associated with the executable file is a first feature associated with the executable file, and wherein the instructions are to cause the processor circuitry to identify a second malware detection output as a true positive malware detection output based on a second feature associated with the executable file not invoking the false positive suppression rule. ### Claim 11 (depends on 10) The at least one non-transitory computer readable storage medium of claim 10, wherein the instructions are to cause the processor circuitry to execute a malware protection operation based on the identification of the second malware detection output as the true positive malware detection output. ### Claim 12 (depends on 11) The at least one non-transitory computer readable storage medium of claim 11, wherein the instructions are to cause the processor circuitry to execute the malware protection operation as one of a quarantining of the executable file, a halting of the execution of the executable file, a prevention of the execution of the executable file, a deletion of the executable file, or a sandboxing of the executable file. ### Claim 13 (depends on 9) The at least one non-transitory computer readable storage medium of claim 9, wherein the executable file is a portable execution file included in a container file. ### Claim 14 (depends on 9) The at least one non-transitory computer readable storage medium of claim 9, wherein the feature is a signature, a type of machine on an endpoint device, a number of sections of a section table, or a size of a header of the executable file. ### Claim 15 (depends on 9) The at least one non-transitory computer readable storage medium of claim 9, wherein the feature associated with the executable file is a first feature associated with the executable file, the executable file is a first executable file, the malware detection output is a first malware detection output, and the instructions are to cause the processor circuitry to: identify second malware detection outputs associated with second executable files as false positive malware detection outputs; generate first data associations of the false positive malware detection outputs and second features of the second executable files; identify third malware detection outputs associated with third executable files as non-false positive malware detection outputs; generate second data associations of the non-false positive malware detection outputs and third features of the third executable files; and execute the rulefit model based on the first data associations and the second data associations to output the false positive suppression rule. ### Claim 16 (depends on 15) The at least one non-transitory computer readable storage medium of claim 15, wherein the instructions are to cause the processor circuitry to cause transmission of the false positive suppression rules to an endpoint device. ### Claim 17 A method comprising: executing, by executing an instruction with a processor, a machine-learning model based on a feature associated with an executable file to generate a malware detection output; after a first determination that the malware detection output identifies the executable file as malware, identifying, by executing an instruction with the processor, the malware detection output as a false positive malware detection output based on the feature invoking false positive suppression rules, wherein the false positive suppression rules are generated based on an execution of a rulefit model trained on false positive detections of malware and non-false positive detections of malware, and wherein the false positive suppression rules include a first false positive suppression rule corresponding to a file size of the executable file and a second false positive suppression rule corresponding to a name of the executable file; and executing, by executing an instruction with the processor, the executable file based on the identification of the malware detection output as the false positive malware detection output. ### Claim 18 (depends on 17) The method of claim 17, wherein the malware detection output is a first malware detection output, the feature associated with the executable file is a first feature associated with the executable file, and further including identifying a second malware detection output as a true positive malware detection output based on a second feature associated with the executable file not invoking the false positive suppression rules. ### Claim 19 (depends on 18) The method of claim 18, further including executing a malware protection operation based on the identification of the second malware detection output as the true positive malware detection output. ### Claim 20 (depends on 19) The method of claim 19, wherein the malware protection operation is one of a quarantining of the executable file, a halting of the execution of the executable file, a prevention of the execution of the executable file, a deletion of the executable file, or a sandboxing of the executable file. ### Claim 21 (depends on 17) The method of claim 17, wherein the executable file is a portable execution file included in a container file. ### Claim 22 (depends on 17) The method of claim 17, wherein the feature is a signature, a type of machine on an endpoint device, a number of sections of a section table, or a size of a header of the executable file. ### Claim 23 (depends on 17) The method of claim 17, wherein the feature associated with the executable file is a first feature associated with the executable file, the executable file is a first executable file, the malware detection output is a first malware detection output, and the method further including: identifying second malware detection outputs associated with second executable files as false positive malware detection outputs; generating first data associations of the false positive malware detection outputs and second features of the second executable files; identifying third malware detection outputs associated with third executable files as non-false positive malware detection outputs; generating second data associations of the non-false positive malware detection outputs and third features of the third executable files; and executing the rulefit model based on the first data associations and the second data associations to output the false positive suppression rules. ### Claim 24 (depends on 23) The method of claim 23, further including transmitting the false positive suppression rules to an endpoint device. ### Claim 25 An apparatus comprising: means for executing a machine-learning model based on a feature associated with an executable file to generate a malware detection output; means for identifying, after a first determination that the malware detection output identifies the executable file as malware, the malware detection output as a false positive malware detection output based on the feature invoking false positive suppression rules, wherein the false positive suppression rules are generated based on an execution of a rulefit model trained on false positive detections of malware and non-false positive detections of malware, and wherein the false positive suppression rules include a first false positive suppression rule corresponding to a file size of the executable file and a second false positive suppression rule corresponding to a name of the executable file; and means for causing execution of the executable file based on the identification of the malware detection output as the false positive malware detection output.