Are there some dataset (set of benign files) that are good for testing false positive of an antivirus? (i.e., detect a benign file as malicious)
closed as off-topic by S.L. Barth, Xander, Bacon Brad, Serge Ballesta, TheJulyPlot Jul 13 '17 at 6:38
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions seeking product recommendations are off-topic as they become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – S.L. Barth, Xander, Bacon Brad, Serge Ballesta, TheJulyPlot
I have plenty of old tools like network tools that are still being detected as false-positive, even if they are tools that have been used for years. Examples: Brutus, Blue's port scanner. Even EasyCD/DVD Burner is detected as possibly dangerous, which is absurd.
Also, pretty much any game crack/keygen is detected as dangerous even in most cases they are perfectly safe.
I have not seen yet even one of the AV companies update their detection status vs. such programs.
I don't think so because it doesn't seem like a reliable way to test antivirus beyond development stage. There are in general many benign files that will be almost always detected as malicious or suspicious (various network scanners, password scrappers) because they are common to use for malicious purposes.
But if you are asking not as an antivirus software user and you need such list for testing your own rules, maybe making your own list tailored for individual rules would be the most useful. You can also upload those files to Virustotal and get the general picture of how is it perceived by other vendors. E.g. if many vendors detect a benign file as malicious, maybe it is not so critical to tweak the rule to not detect it. Or if your rule detects the benign file as malicious but none of the vendors in VT, then something can be done to rule out this false positive.
You may want to take a look at this one: