Windows 10: Windows Defender ATP partnering w/ industry to reduce false positives

Brink · Aug 17, 2018

Every day, antivirus capabilities in Windows Defender Advanced Threat Protection (Windows Defender ATP) protect millions of customers from threats. To effectively scale protection, Windows Defender ATP uses intelligent systems that combine multiple layers of machine learning models, behavior-based detection algorithms, generics, and heuristics that make a verdict on suspicious files, most of the time in a fraction of a second.

This multilayered approach allows us to proactively protect customers in real-time, whether in the form of stopping massive malware outbreaks or detecting limited sophisticated cyberattacks. This quality of antivirus capabilities is reflected in the consistently high scores that Windows Defender ATP gets in independent tests and the fact that our antivirus solution is the most deployed in the enterprise.

The tradeoff of an intelligent, scalable approach is that some of our more aggressive classifiers from time to time misclassify normal files as malicious (false positives). While false positives are a very tiny occurrence compared to the large number of malware we correctly identify (true positives) and protect customers from, we are aware of the impact that misclassified files might have. Keeping false positives at a minimum is an equally important quality metric that we continually work to improve on.

Avoiding false positives is a two-way street between security vendors and developers. Publishing apps to the Microsoft Store is the best way for vendors and developers to ensure their programs are not misclassified. For customers, apps from the Microsoft Store are trusted and Microsoft-verified.

Here are other ways developers can raise the level of trust by both security vendors and customers and help make sure programs and files are not inadvertently detected as malware.

Digitally sign files

Digital signatures are an important way to ensure the integrity of software. By verifying the identity of the software publisher, a signature assures customers that they know who provided the software they’re installing or running. Digital signatures also assure customers that the software they received is in the same condition as when the publisher signed it and the software has not been tampered with.

Code signing does not necessarily guarantee the quality or functionality of software. Digitally signed software can still contain flaws or security vulnerabilities. However, because software vendors’ reputations are based on the quality of their code, there is an incentive to fix these issues.

We use the reputation of digital certificates to help determine the reputation of files signed by them. The reverse is also true: we use the reputation of digitally signed files to determine the reputation of the digital certificates they are signed with. One of the most effective ways for developers to reduce the chances of their software being detected as malware is it to digitally sign files with a reputable certificate.

The second part of reducing the risk of unintended detection is to build a good reputation on that certificate. Microsoft uses many factors to determine the reputation of a certificate, but the most important are the files that are signed by it. If all the files using a certificate have good reputation and the certificate is valid, then the certificate keeps a good reputation.

Extended validation (EV) code signing is a more advanced version of digital certificates and requires a more rigorous vetting and authentication process. This process requires a more comprehensive identity verification and authentication process for each developer. The EV code signing certificates require the use of hardware to sign applications. This hardware requirement is an additional protection against theft or unintended use of code signing certificates. Programs signed by an EV code signing certificate can immediately establish reputation with Windows Defender ATP even if no prior reputation exists for that file or publisher.

Keep good reputation

To gain positive reputation on multiple programs and files, developers sign files with a digital certificate with positive reputation. However, if one of the files gains poor reputation (e.g., detected as malware) or if the certificate was stolen and used to sign malware, then all of the files that are signed with that certificate will inherit the poor reputation. This situation could lead to unintended detection. This framework is implemented this way to prevent the misuse of reputation sharing.

We thus advise developers to not share certificates between programs or other developers. This advice particularly holds true for programs that incorporate bundling or use advertising or freemium models of monetization. Reputation accrues—if a software bundler includes components that have poor reputation, the certificate that bundler is signed with gets the poor reputation.

Be transparent and respect users’ ability to choose

Malware threats use a variety of techniques to hide. Some of these techniques include file obfuscation, being installed in nontraditional install locations, and using names that don’t reflect that purpose of the software.

Customers should have choice and control over what happens on their devices. Using nontraditional install locations or misleading software names reduce user choice and control.

Obfuscation has legitimate uses, and some forms of obfuscation are not considered malicious. However, many techniques are only employed to evade antivirus detection. Developers should refrain from using non-commercial packers and obfuscation software.

When programs employ malware-like techniques, they trigger flags in our detection algorithms and greatly increase the chances of false positives.

Keep good company

Another indicator that can influence the reputation of a file are the other programs the file is associated with. This association can come from what the program installs, what is installed at the same time as the program, or what is seen on the same machines as the file. Not all of these associations directly lead to detections, however, if a program installs other programs or files that have poor reputation, then by association that program gains poor reputation.

Understand the detection criteria

Microsoft’s policy aims to protect customers against malicious software while minimizing the restrictions on developers. The diagram below demonstrates the high-level evaluation criteria Microsoft uses for classifying files:

Malicious software: Performs malicious actions on a computer

Unwanted software: Exhibits the behavior of adware, browser modifier, misleading, monitoring tool, or software bundler

Potentially unwanted application (PUA): Exhibits behaviors that degrade the Windows experience

Clean: We trust the file is not malicious, is not inappropriate for an enterprise environment, and does not degrade the Windows experience

These evaluation criteria describe the characteristics and behavior of malware and potentially unwanted applications and guide the proper identification of threats. Developers should make sure their programs and files don’t demonstrate undesirable characteristics or behavior to minimize chances their programs are not misclassified.

Challenging a detection decision

If you follow these pieces of advice and we unintentionally detect your file, you can help us fix the issue by reporting it through the Windows Defender Security Intelligence portal.

Customer protection is our top priority. We deliver this through Windows Defender ATP’s unified endpoint security platform. Helping Microsoft maintain high-quality protection benefits customers and developers alike, allowing for an overall productive and secure computing experience.

Michael Johnson
Windows Defender Research
Click to expand...

Source: https://cloudblogs.microsoft.com/mic...lse-positives/

:)

Brink · Aug 17, 2018

Microsoft partners extend Windows Defender ATP across platforms

Organizations often use computers, operating systems, and databases from a variety of vendors. That’s why today, we’re excited to announce three leading security companies – Bitdefender, Lookout, and Ziften – are partnering with us to enable Windows Defender Advanced Threat Protection (ATP) to detect, protect, and respond to security threads on macOS, Linux, iOS, and Android devices.

We’ve heard from our customers that they want protection and visibility into potential threats on all of their device platforms and we’ve turned to partners to help address this need.

Windows Defender ATP provides security teams a single pane of glass for their endpoint security and now by collaborating with these partners, our customers can extend their ATP service to their entire install base.

Security Dashboard: Single pane of glass view for all your on boarded endpoints

With Windows Defender ATP, all threats and detections feed into the console; every device has its own rich machine timeline, with event history for up to six months; and Security Operations (SecOps) can benefit from the same instantaneous search capabilities over historical data across all their endpoints.

Machine page: Detailed process tree view of an event collected by Ziften

We have been working closely with our partners to ensure the integration of their solutions with Windows Defender ATP is simple and easy to implement with only a few clicks. There are no requirements for any additional infrastructure, and once the integration is set, new events from on boarded macOS, Linux, iOS and Android devices will start surfacing into the Windows Defender ATP console.

Alert page: Details for a malware detection on a macOS device raised by Bitdefender

Bitdefender, Lookout, and Ziften are the first of several strategic partnerships coming for Windows Defender ATP as we continuously expand and innovate with the goal of giving security teams better ways to detect, investigate and respond to cyber-attacks and breaches on their networks.

Bitdefender’s GravityZone Cloud enables customers to view comprehensive threat intelligence information on malware and suspicious files, such as threat type, threat category, and many other relevant details.

Lookout Mobile Endpoint Security gives customers real-time visibility into incidents on mobile devices and lets them respond quickly and effectively.

Ziften’s Zenith systems and security operations platform helps customers to detect attacks and zero-day exploits, to uncover the full scope of a breach, and to quickly respond to contain attacks.

Our integration with Bitdefender is available now in Public Preview. To learn more and to get started with a trial version, take a look at their FAQ page. Lookout and Ziften will be joining our Public Preview Program with their integrated solutions soon. For more details availability notification, head over to their websites (Lookout, Ziften), to register for trial versions.

We are gratified by the reception that Windows Defender ATP has received since our first announcement 20 months ago. In that time, we have added new classes of capability and innovative protection, including ground-breaking detections, new Security Analytics to deliver insights on your company’s overall security stance, and automated remediation with Hexadite technology.

We believe for security to be the most effective, it must be comprehensive. As attackers continue to move quickly, the security industry must work together to provide integrated experiences and technology. The end result is the best possible protection for the customer.
Click to expand...

Source: Microsoft partners extend Windows Defender ATP across platforms - Windows For Your Business

Joanna 777 · Aug 17, 2018

defender false positive

Hi Bob,

To better assist you, kindly verify the following:

Where did you submit the file about Windows Defender being false positive?

Right after the recent Windows 10 update, your Zara Radio stopped working?

Regarding the 404 error, what application were you using when you got that error?

Let us know.

AnthonyPosi · Aug 17, 2018

Windows Defender ATP.

Why isn't the Windows Defender ATP platform available with Windows 10 Pro for free? What's the difference between Windows Defender and Windows Defender ATP? If you're going to make Windows 10 the best operating system ever, the virus and malware protection
has to be the best too. So having one Windows Defender ATP across the whole Windows 10 ecosystem for free is better then having two different virus and malware platforms?

Windows 10: Windows Defender ATP partnering w/ industry to reduce false positives

Windows Defender ATP partnering w/ industry to reduce false positives

Windows Defender ATP partnering w/ industry to reduce false positives

Windows Defender ATP partnering w/ industry to reduce false positives

Windows Defender ATP partnering w/ industry to reduce false positives - Similar Threads - Defender ATP partnering

False positive??

False positive??

False positive in Defender?

A false positive detected by Windows Defender

Windows Defender False-Positives loop

Feedback for Windows Defender false positive found

Windows Defender ATP ExploitGuard False Web Block.

Windows Defender False Positives

Microsoft partners extend Windows Defender ATP across platforms