The ECU detects which cylinder is knocking based on the premise that knock occurs in a window of crankshaft rotation during which cylinder pressure is rising post ignition event. If the knock sensor generates sufficient voltage, and a cylinder is within that knock window, the ECU increments the knock sum for that cylinder. In addition, if the knock voltage is sufficient enough to surpass the calculated background noise under current engine conditions, and the engine is operating within the RPM and load range over which feedback or fine knock learning may occur, the ECU will react to the knock event by pulling timing, in steps based on the processed knock data. While the ECU can use this method to take an educated guess as to which cylinder is likely knocking, the knock response of pulling timing affects all cylinders. Subaru does not perform per cylinder knock based timing correction on the STI, though that may be something they add in the future.
Whether the knock sum you're experiencing is false or not you can't say based on it occurring in a single cylinder. Keep in mind the knock sensor is a piezo element, a contact microphone, so any noise occurring within the knock window which is within the frequency range the sensor is tuned to, and of sufficient amplitude, can be registered as knock by the ECU. As just one example of how you can get false knock on a single cylinder, excessive valve lash on a single bucket could cause excessive valvetrain noise which happens to occur within the knock window for a cylinder. The noise may not even be occurring in the same cylinder the knock is being detected...it may just happen to occur within the knock monitoring window for cylinder 1.
Using high quality, highly knock resistant fuel is one way to start narrowing things down. If you're running pump gas, retuning for e85 to see if the knock events continue being detected is a common path forward.