About We shield

[claudiubo]

Hello,

Is Web shield strictly based on a black list/ white list? 

I am asking this because I see every time a FP is being reported , the answer is "will be fixed in the next 10 min" which suggests a white list /black list approach.

Thank you. 

[Porthos]

6 hours ago, claudiubo said:

I am asking this because I see every time a FP is being reported , the answer is "will be fixed in the next 10 min" which suggests a white list /black list approach.

The "will be fixed in the next 10 min" is for File FP's. They are whitelisted in the cloud.

Web FP's  are fixed by a database update. Yes it is a white list /black list. The update is released at the scheduled database release. Things are added to it manually and automatically from sources that will not be disclosed.

That is why I mentioned Malwarebytes Browser Guard. It is not solely white list /black list it is AI as well.

[AdvancedSetup]

The majority of false positives come from the artificial intelligence flagging it. It needs to learn to improve and has drastically. In the early years before it was even released to the public and only tested internally the detection rate was very low but the fp rate was very high. Today it detects very good and the fp has been greatly decreased.

 

[claudiubo]

8 hours ago, AdvancedSetup said:

The majority of false positives come from the artificial intelligence flagging it. It needs to learn to improve and has drastically. In the early years before it was even released to the public and only tested internally the detection rate was very low but the fp rate was very high. Today it detects very good and the fp has been greatly decreased.

 

Thank you for your answer!

While we are here, what is the difference between "artificial intelligence" and "expert system algorithms"  ?

The later one is off by default and the advice is to keep it off. Why do we have it , then?

 

Thanks!

[Porthos]

4 hours ago, claudiubo said:

Why do we have it , then?

This setting is in the experimental stage.

That setting is to detect malformed files, but sometimes legit files use protection that make them malformed. Malwarebytes is still tweaking the algorithms that is why it’s off by default. If you switch it on it is assumed, you can tell the difference between a FP and a legit detection. 

And if you keep it on, I suggest also turn off auto quarantine. Gives you the time to report FP's and not go thru the extra step to have to restore from quarantine.