US Patent 8028338 Modeling goodware characteristics to reduce false positive malware signatures

A set of likelihood values associated with a set of characteristics associated with the set of goodware entities is determined. The set of characteristics is stored in association with the set of likelihood values as a model. A set of relative information gain values associated with the characteristics of the set of characteristics is generated. One or more characteristics are removed from the model responsive to the relative information gain values associated with the one or more characteristics to produce a revised model.