False Positive

A false positive is an error in binary classification in which a test result incorrectly indicates the presence of a condition (such as a disease when the disease is not present), while a false negative is the opposite error, where the test result incorrectly indicates the absence of a condition when it is actually present. These are the two kinds of errors in a binary test, in contrast to the two kinds of correct result (a .mw-parser-output .vanchor>:target.vanchor-textbackground-color:#b1d2fftrue positive and a true negative). They are also known in medicine as a false positive (or false negative) diagnosis, and in statistical classification as a false positive (or false negative) error.[1]

False Positive

In statistical hypothesis testing, the analogous concepts are known as type I and type II errors, where a positive result corresponds to rejecting the null hypothesis, and a negative result corresponds to not rejecting the null hypothesis. The terms are often used interchangeably, but there are differences in detail and interpretation due to the differences between medical testing and statistical hypothesis testing.

A false positive error, or false positive, is a result that indicates a given condition exists when it does not. For example, a pregnancy test which indicates a woman is pregnant when she is not, or the conviction of an innocent person.

A false positive error is a type I error where the test is checking a single condition, and wrongly gives an affirmative (positive) decision. However it is important to distinguish between the type 1 error rate and the probability of a positive result being false. The latter is known as the false positive risk (see Ambiguity in the definition of false positive rate, below).[2]

A false negative error, or false negative, is a test result which wrongly indicates that a condition does not hold. For example, when a pregnancy test indicates a woman is not pregnant, but she is, or when a person guilty of a crime is acquitted, these are false negatives. The condition "the woman is pregnant", or "the person is guilty" holds, but the test (the pregnancy test or the trial in a court of law) fails to realize this condition, and wrongly decides that the person is not pregnant or not guilty.

The false positive rate (FPR) is the proportion of all negatives that still yield positive test outcomes, i.e., the conditional probability of a positive test result given an event that was not present.

Complementarily, the false negative rate (FNR) is the proportion of positives which yield negative test outcomes with the test, i.e., the conditional probability of a negative test result given that the condition being looked for is present.

The term false discovery rate (FDR) was used by Colquhoun (2014)[4] to mean the probability that a "significant" result was a false positive. Later Colquhoun (2017)[2] used the term false positive risk (FPR) for the same quantity, to avoid confusion with the term FDR as used by people who work on multiple comparisons. Corrections for multiple comparisons aim only to correct the type I error rate, so the result is a (corrected) p-value. Thus they are susceptible to the same misinterpretation as any other p-value. The false positive risk is always higher, often much higher, than the p-value.[4][2]

Confusion of these two ideas, the error of the transposed conditional, has caused much mischief.[5] Because of the ambiguity of notation in this field, it is essential to look at the definition in every paper. The hazards of reliance on p-values was emphasized in Colquhoun (2017)[2] by pointing out that even an observation of p = 0.001 was not necessarily strong evidence against the null hypothesis. Despite the fact that the likelihood ratio in favor of the alternative hypothesis over the null is close to 100, if the hypothesis was implausible, with a prior probability of a real effect being 0.1, even the observation of p = 0.001 would have a false positive rate of 8 percent. It wouldn't even reach the 5 percent level. As a consequence, it has been recommended[2][6] that every p-value should be accompanied by the prior probability of there being a real effect that it would be necessary to assume in order to achieve a false positive risk of 5%. For example, if we observe p = 0.05 in a single experiment, we would have to be 87% certain that there as a real effect before the experiment was done to achieve a false positive risk of 5%.

The U.S. Food and Drug Administration (FDA) is alerting clinical laboratory staff and health care providers that false positive results can occur with antigen tests, including when users do not follow the instructions for use of antigen tests for the rapid detection of SARS-CoV-2. Generally, antigen tests are indicated for the qualitative detection of SARS-CoV-2 antigens in authorized specimen types collected from individuals who are suspected of COVID-19 by their healthcare provider within a certain number of days of symptom onset. The FDA is aware of reports of false positive results associated with antigen tests used in nursing homes and other settings and continues to monitor and evaluate these reports and other available information about device safety and performance.

The FDA reminds clinical laboratory staff and health care providers about the risk of false positive results with all laboratory tests. Laboratories should expect some false positive results to occur even when very accurate tests are used for screening large populations with a low prevalence of infection. Health care providers and clinical laboratory staff can help ensure accurate reporting of test results by following the authorized instructions for use of a test and key steps in the testing process as recommended by the Centers for Disease Control and Prevention (CDC), including routine follow-up testing (reflex testing) with a molecular assay when appropriate, and by considering the expected occurrence of false positive results when interpreting test results in their patient populations.

Like molecular tests, antigen tests are typically highly specific for the SARS-CoV-2 virus. However, all diagnostic tests may be subject to false positive results, especially in low prevalence settings. Health care providers should always carefully consider diagnostic test results in the context of all available clinical, diagnostic and epidemiological information. Test interference from patient-specific factors, such as the presence of human antibodies (for example, Rheumatoid Factor, or other non-specific antibodies) or highly viscous specimens could also lead to false positive results.

Amphetamines and methamphetamines are part of an important class of drugs included in most urine drugs of abuse screening panels, and a common assay to detect these drugs is the Amphetamines II immunoassay (Roche Diagnostics). To demonstrate that meta-chlorophenylpiperazine (m-CPP), a trazodone metabolite, cross-reacts in the Amphetamines II assay, we tested reference standards of m-CPP at various concentrations (200 to 20,000 g/L). We also tested real patient urine samples containing m-CPP (detected and quantified by HPLC) with no detectable amphetamine, methamphetamine, or MDMA (demonstrated by GC MS). In both the m-CPP standards and the patient urine samples, we found a strong association between m-CPP concentration and Amphetamines II immunoreactivity (r = 0.990 for the urine samples). Further, we found that patients taking trazodone can produce urine with sufficient m-CPP to result in false-positive Amphetamines II results. At our institution, false-positive amphetamine results occur not infrequently in patients taking trazodone with at least 8 trazodone-associated false-positive results during a single 26-day period. Laboratories should remain cognizant of this interference when interpreting results of this assay.

In endpoint protection solutions, a false positive is an entity, such as a file or a process that was detected and identified as malicious even though the entity isn't actually a threat. A false negative is an entity that wasn't detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution, including Defender for Endpoint.

Fortunately, steps can be taken to address and reduce these kinds of issues. If you're seeing false positives/negatives occurring with Defender for Endpoint, your security operations can take steps to address them by using the following process:

If you see an alert that arose because something's detected as malicious or suspicious and it shouldn't be, you can suppress the alert for that entity. You can also suppress alerts that aren't necessarily false positives, but are unimportant. We recommend that you also classify alerts.

Managing your alerts and classifying true/false positives helps to train your threat protection solution and can reduce the number of false positives or false negatives over time. Taking these steps also helps reduce noise in your queue so that your security team can focus on higher priority work items.

Alerts can be classified as false positives or true positives in the Microsoft 365 Defender portal. Classifying alerts helps train Defender for Endpoint so that over time, you'll see more true alerts and fewer false alerts.

If you have alerts that are either false positives or that are true positives but for unimportant events, you can suppress those alerts in Microsoft 365 Defender. Suppressing alerts helps reduce noise in your queue.

After you've reviewed your alerts, your next step is to review remediation actions. If any actions were taken as a result of false positives, you can undo most kinds of remediation actions. Specifically, you can:

In general, you shouldn't need to define exclusions for Microsoft Defender Antivirus. Make sure that you define exclusions sparingly, and that you only include the files, folders, processes, and process-opened files that are resulting in false positives. In addition, make sure to review your defined exclusions regularly. We recommend using Microsoft Intune to define or edit your antivirus exclusions; however, you can use other methods, such as Group Policy (see Manage Microsoft Defender for Endpoint. 041b061a72