Methods and apparatus to detect malware using micro-forests with customer trust seeds

Abstract

Methods and apparatus are disclosed to detect malware using micro-forests with customer trust seeds. A false positive correction apparatus includes processor circuitry to perform at least one of the first operations, the second operations or the third operations to instantiate classifier circuitry to access a malicious sample, the malicious sample having a first feature vector, sample comparison circuitry to compare the malicious sample to a known sample, the known sample collected from customer data, the known sample having a second feature vector, calculator circuitry to calculate a distance value between the first feature vector and the second feature vector, threshold comparator circuitry to compare the distance value to a threshold, and change the classification of the malicious sample to clean in response to the distance value satisfying the threshold.