Microsoft patents math model to spot ransomware attacks in real time
Microsoft describes a security tool that uses a specific type of machine learning to detect ransomware while it is happening. The system analyzes computer activity to distinguish malicious actions from normal use, allowing it to stop attacks before they spread.
In the filing’s own words
The techniques disclosed herein identify ransomware attacks as they are occurring, improving the security and functionality of computer systems. Ransomware attacks are identified using a new probabilistic machine learning model that better handles the unique properties of ransomware data. Ransomware data includes a list of computing operations, some of which are labeled as being associated with ransomware attacks. In contrast to deterministic machine learning techniques that learn weights, probabilistic machine learning techniques learn the parameters of a distribution function. In some configurations, a radial Spike and Slab distribution function is used within a Bayesian neural network framework to better handle sparse, missing, and imbalanced data. Once trained, the machine learning model may be provided with real-time operations, e.g., from a cloud service security module, from which to infer whether a ransomware attack is taking place.
What exactly they claim (claim 1)
1. A method comprising: receiving a data set comprising records of a first plurality of computer operations that have been labeled as being caused by ransomware or not being caused by ransomware; training a probabilistic machine learning model with posterior Spike and Slab distributions using the received data set, wherein an individual posterior Spike and Slab distribution is an aggregation of a slab distribution function and a spike distribution function, wherein the individual posterior Spike and Slab distribution has a first probability of being sampled from the slab distribution and a second probability of being sampled from the spike distribution, and wherein training the probabilistic machine learning model includes learning the first probability and the second probability by sampling values from a prior Spike and Slab distribution function and updating the first probability and the second probability based on how well the probabilistic machine learning model explains labeled records of the data set when evaluated using the sampled values; receiving a second plurality of computer operations that were performed in part by a computing device over a defined period of time; identifying features associated with ransomware attacks from the second plurality of computer operations; applying the trained probabilistic machine learning model to infer that at least some of the second plurality of computer operations were caused by ransomware; and applying a security countermeasure to the computing device to disable a potential ransomware attack associated with the second plurality of computer operations.
Facts
- Company
- Microsoft (MICROSOFT TECHNOLOGY LICENSING, LLC)
- Official title
- Bayesian neural networks for ransomware incident detection
- Patent number
- US12725011B2
- Application number
- 17720294
- Filed
- Apr 14, 2022
- Granted
- Sep 1, 2026
- Inventors
- 5
- Claims
- 19
Classified under
G06N 3/047 Physics & computingG06F 21/561 Physics & computingG06N 3/08 Physics & computingMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.