Decreasing false positives- a smart white list

[Shaheen]

I have an idea for CH. Being a behave blocker, CH might have some false positives. What about adding a smart white list( just like you have added a black list)? It will rduce the false positives a lot.

BTW this white list should work only on a trigger even/ behavior, just like the black list in CH.

Thanks,

[djames]

We do have a "white" list, and it is only queried if suspicious behavior is detected. This is just one way we try and avoid FPs, but this is an ongoing battle.

[Shaheen]

I never knew this.

Thanks for the reply.