Prevx heuristics adjustments vs false positives

Discussion in 'Prevx Releases' started by Jeroen1000, Apr 12, 2010.

Thread Status:
Not open for further replies.
  1. Jeroen1000

    Jeroen1000 Registered Member

    Joined:
    Aug 18, 2008
    Posts:
    162
    I've been wondering for some time about this now, please enlighten me:)

    Sometimes, Prevx sees a FP because a "definition" has become too heuristic. Fine, this can be fixed quickly. However, is it possible that real virusses that were previously detected are missed since the heuristic detection rule has been altered?
     
  2. PrevxHelp

    PrevxHelp Former Prevx Moderator

    Joined:
    Sep 14, 2008
    Posts:
    8,242
    Location:
    USA/UK
    When we fix a FP, it generally could tune down the heuristics slightly for other files as well, but at that point we're able to see exactly what component of the rule caused the FP and because of our database, we're able to see exactly how many files would be affected by it, so we are able to make very fine-tuned adjustments :) On the other side, however, we have some rules which find 300,000+ infections from a single heuristic and have produced 3-4 FPs. In that case, we just whitelist the individual files :)

    Hope that helps!
     
  3. Jeroen1000

    Jeroen1000 Registered Member

    Joined:
    Aug 18, 2008
    Posts:
    162
    Thanks Joe, I have been educated:D I was just a tad worried that detection might get worse whenever a rule is adjusted because of an FP. Although you do not exclude that scenario, I feel at ease by the way you go about it.
     
Thread Status:
Not open for further replies.