SONAR (Symantec Online Network for Advanced Response)utilizesSymantec Insightto help reduce false positives in malware detection. Symantec Insight provides a reputation-based system that evaluates the trustworthiness of files based on data gathered from millions of endpoints worldwide.
* How Symantec Insight Reduces False Positives:
* Insight assigns reputation scores to files, which helps SONAR determine whether a file is likely benign or potentially malicious. Files with high reputation scores are less likely to be flagged as threats.
* This reputation-based analysis allows SONAR to avoid marking trusted files (e.g., common, widely-used applications) as malicious, thus reducing the rate of false positives.
* Advantages Over Other Options:
* While virus and spyware definitions (Option A) provide detection signatures, they are static and do not offer the real-time, behavior-based analysis that Insight provides.
* TheFile Fingerprint list(Option B) andExtended File Attributes (EFA) table(Option D) are not used by SONAR specifically for false-positive reduction.
References: Symantec Insight's integration with SONAR enhances threat detection accuracy by minimizing false positives based on file reputation and prevalence.