VirusTotal adds “Trusted Source” Flag to combat false positive detections (false positives).
Online file scanning service VirusTotal has implemented a new project designed to reduce the number of false positives displayed on its pages and is now adding a “Trusted Source” flag to files marked as safe by a reputable antivirus company.
The scanned file will appear with this distinction only if it is available in the software catalog of the company participating in the project and an antivirus software vendor has mistakenly flagged it as a threat.
False positive results are often attributed to generic signatures and heuristic analysis that may interpret certain routines of the scanned file as malicious, even though they are perfectly legitimate.
The project is in its early stages, and VirusTotal's first step is to convince major software manufacturers to share their program databases with the service. Of course, this will also help Google build a secure database of software and reduce its false positive rate when files are retrieved through its services.
When an incorrect result occurs from one of the antivirus included in the service, they receive a notification about the error, allowing them to correct the issue.
Additionally, only the “safe” flag will appear on the result page for a file that has been identified in the software catalog of a trusted source. The false detection is not completely eliminated, and the incorrect results are available at the bottom of the scan report.
The first partner in the project is Microsoft and although the effort to remediate false positives is only a week old, some very encouraging results have been recorded, with more than 6,000 false positives already remediated.
Major software development companies can participate in the program and submit their programs to VirusTotal, which will take the necessary measures to reduce the false positive detection rate of antivirus.
The choice for the major manufacturers is obvious, given that they must defend their reputation in order to continue their business activities as effectively as possible.
VirusTotal warns that its initiative is not open to all developers, no matter how big they are. “Please note that this initiative is not open to potentially unwanted applications and adware developers,” explained Emiliano Martinez in a blog post on Tuesday.
