Are there some dataset (set of benign files) that are good for testing false positive of an antivirus? (i.e., detect a benign file as malicious)

  • 1
    Whats wrong with an eicar test file? – TheJulyPlot Jul 12 '17 at 10:55
  • 2
    @TheJulyPlot he's asking for the opposite. medind.nic.in/jay/t13/i5/… – daniel Jul 12 '17 at 11:44
  • @daniel Ahh I see. – TheJulyPlot Jul 12 '17 at 11:46
  • 1
    I think both Antivirus vendor and malware creators also want to know the perfect answer. – mootmoot Jul 12 '17 at 14:09

I have plenty of old tools like network tools that are still being detected as false-positive, even if they are tools that have been used for years. Examples: Brutus, Blue's port scanner. Even EasyCD/DVD Burner is detected as possibly dangerous, which is absurd.

Also, pretty much any game crack/keygen is detected as dangerous even in most cases they are perfectly safe.

I have not seen yet even one of the AV companies update their detection status vs. such programs.

| improve this answer | |

I don't think so because it doesn't seem like a reliable way to test antivirus beyond development stage. There are in general many benign files that will be almost always detected as malicious or suspicious (various network scanners, password scrappers) because they are common to use for malicious purposes.

But if you are asking not as an antivirus software user and you need such list for testing your own rules, maybe making your own list tailored for individual rules would be the most useful. You can also upload those files to Virustotal and get the general picture of how is it perceived by other vendors. E.g. if many vendors detect a benign file as malicious, maybe it is not so critical to tweak the rule to not detect it. Or if your rule detects the benign file as malicious but none of the vendors in VT, then something can be done to rule out this false positive.

| improve this answer | |

You may want to take a look at this one:

Anti malware test file

| improve this answer | |
  • Thanks, I guess this is targeted by all antiviruses as malicious file therefore no much value. First I need a benign file, second it is classified as malicious. – william007 Jul 12 '17 at 11:37
  • Have you tried to create a file with msfvenom? You can play with the iterations and the encoder until you get a malicious file (usually used for a reverse shell) but undetected from AV. – antonis_man Jul 12 '17 at 11:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.