Highest Detection Vs. False Alarm

Hello Fellow Security peeps,

I was just curious about how everyone feels about high detection rates. At Av-comparatives for example....they look down upon AV's for having false alarms even though they have stopped more of newest viruses. I recently visited the site, and Symantec had been given the AV product of the year.

I just thought I would rather have more FP's as long as more positives were in fact, found. Ikarus had been one I have looked at for years...along with the obvious avira, trustport...etc...(ones with highest detection).

This has probably been talked about before on here...but I just wanted some more opinions....

 

i think there s a thread with this discussion but i will answer this question.
I would rather have fp than missed viruses.

 

In some products, to some extent, you can control the proclivity for false positive detections. For example, with Norton Internet Security 2010 you can “throttle-up” the heuristic detection setting to “aggressive” from its normal “automatic” setting, if you prefer.

 

On the whole I'd always go for a few extra FPs with a higher detection rate.In some cases I welcome FPs if they pertain to niche products that operate in a similar fashion to malware,it shows me the heuristics are doing their job.
It's a fine balance though as FPs on commonly used software can be most annoying.

 

It isnt one or the other, I would not except having any product that suceeds at one and fails at the other. To me it is a no-brainer, a product should be able to do both or it is crap.

Why should anyone settle for less.

 

enough said! i agree.

 

Me too.

Regards,
Jerry

 

Agree, i prefer FP's, because i still have my final judgement to see if it's a virus or not.
But if it's missed you're pretty much done

 

I personally think it depends on a person experience with computers, but for me I would go for highest detection.

 

Those who know about malware and AVs may sacrifice quality over detections, but you can't discount the general public who leave AVs on automatic or delete everything their AVs detect (understandably)... having high FPs is a major issue for the majority of the population, regardless of how many people on Wilders say they can sacrifice low FPs for more detection - of course, this is a forum where people are aware of issues. Most people are not.

 

That pretty well sums it up for us average users. So far I must say that some AVs have done an excellent job of high detection rates while having very few FP.

I would assume that the general public buys the most, and so being sensitive to their needs and abilities is necessary.

Regards,
Jerry

 

Imagine you don't have 1-5 PC's, but that you're responsible for 12,000.

Do you then want better detection, or fewer FP's, or the best balance of both possible?

 

I love these words

 

A few years back, due to an FP from Kaspersky, I hosed my XP by deleting svchost.exe which was wrongly identified as malware. That was before I spend time here at Wilders.

So, FP is as dangerous as missed detection. It depends very much on the experience of the users. For most users here, I think highest detection is much preferred even at the expense of higher FP, but this may not necessarily applicable to the general public users.

 

I completely agree some false positives can cause much more damage then what a malware infection can do. I remember awhile back when one of the mainstream Anti-Virus had a faulty update that detected boot sectors as malware and then quarantined them or deleted them which made Windows not able to boot up. Most malware will not cause Windows to not be able to boot because they want Windows to run because they can do their malicious duties.

I have had Anti-Virus softwares to detect false positives in my Compaq Recovery Console which if I removed then I could not recover my system.

I rather have a infection which could be removed, then a system that can't be recovered because of false positives.

Thanks.