False positive

A false positive in the field of cybersecurity is a situation in which a security or antivirus system detects and flags legitimate activity or a legitimate file as a threat or malicious activity, when in fact it is not.

Causes of a false positive

False positives occur unexpectedly and for reasons that are unclear to the average user. There is no single, definitive cause of a false positive, but rather a range of possible causes:

Inaccurate virus signatures

Antivirus systems use signature databases, which consist of code snippets or characteristic patterns of malware known. If these signatures are not clearly defined, they may match legitimate files.

Let us suppose that a Word file contains a macro that automates tasks within the document. If the antivirus signature includes code patterns similar to those used in that macro, the antivirus programme might incorrectly identify the Word file as malicious.

Software behaviour (heuristics)

Many antivirus programmes also analyse the behaviour of software programmes to alert the user and block actions they deem suspicious. Thus, if a programme – even if it is harmless – performs actions that the antivirus programme considers unusual or too risky due to the way it is configured, it will flag it as malicious.

For example, an automatic update programme that modifies files in the system folder may end up on the blacklist of many antivirus programmes.

Recent updates

When updating an antivirus programme, new virus definition files and detection rules are often installed which are not yet fully tested, which can lead to false positives.

A plausible example would be if, following an antivirus update, certain files from a legitimate game were to be detected as malware. This could be because the updated virus information accidentally matches parts of the game’s code.

Strict security settings

When a security programme is configured to be extremely sensitive, it may detect threats where none exist. A very strict configuration increases the likelihood of false positives, so it is important to strike a reasonable balance.

Conflicts between security programmes

If you have two antivirus programmes installed, one might interpret the other’s actions as malicious. For example, when one antivirus programme attempts to access files to scan them, the other might detect this as an unauthorised attempt to modify those files and trigger an alert.

The consequences of false positives for businesses

One might think that false positives, as they amount to a false alarm and are not actually preceded by any cyber-attack, are of little significance. Whilst they are not as harmful as a false negative, do indeed have negative consequences for users, particularly in a business context.

Firstly, false positives are a nuisance, as, in some cases, we have to take the time to identify them as such. If we download a new piece of software and the antivirus alerts us to a potential threat, our first instinct will be to uninstall the programme and look for an alternative solution. Therefore, If we want to identify a false positive, we must take the trouble to investigate until we can determine that it is indeed one.

Therefore, in a company, false positives are synonymous with drop in productivity, as it adds yet another unforeseen task to the current workflow, which causes delays and may hinder the completion of other, more important tasks.

Secondly, false positives arouse suspicion among the general user base. If an antivirus programme frequently makes mistakes when detecting a cyber threat, why should we trust it blindly? Without realising it, we are tempted to ignore certain warnings from the antivirus programme, assuming they are false positives, which It could lead to a real virus finding its way into the computer system.

Ultimately, false positives are detrimental to a business because they disrupt work processes, undermine user trust and reduce our vigilance when it comes to detecting threats.

How can false positives be resolved?

There is no set plan for definitively resolving false positives, but there are some practices that can help us detect them and ensure that the antivirus software works more effectively. Here are some steps you can take to minimise false positives:

• Update your antivirus software: Make sure your antivirus software is always up to date. Updates refresh the virus signature database and optimise the detection algorithms for vulnerabilities.
• Check the detected file or programme: Investigate the file or programme that has been flagged as a threat. Look for information online to check whether other users have encountered the same problem.
• Send a report to the antivirus provider: Many antivirus providers offer users a way to report false positives. You can submit the detected file or programme so that the technical support team can review it and remove it from future scans.
• Add to the exclusion list: If you are sure that the file or programme is safe, add it to the antivirus exclusion list so that the antivirus does not flag it as a threat again in future.
• Scan with another antivirus programme: Use a secondary antivirus programme or an online scanning tool to check whether the file is actually a false positive. If several antivirus programmes fail to detect a threat, it is more likely to be a false positive.
• Set the sensitivity levels: As we mentioned, many false positives arise from a system’s antivirus software being set up too restrictively. That is why we recommend checking the antivirus settings and parameters to ensure they are not the cause of the false positives. However, do be careful, as relaxing your antivirus security settings could mean you overlook real threats.