Microsoft patents security alerts that adapt to local threat patterns
This patent describes a system that analyzes security threats by comparing them to past incidents in specific geographic areas. It uses mathematical representations called embeddings to match the current threat with similar historical events and suggests appropriate security actions based on regional models.
In the filing’s own words
Techniques are described herein that are capable of providing a geographically diversified embedding-based guided response to a security alert. A security alert regarding an identified security incident that is associated with an entity is received. Sets of designated security incidents, which are similar to the identified security incident, may be selected from sets of historical security incidents associated with respective geographical regions based on embeddings of the identified security incident and the historical security incidents in the sets. The identified security incident is classified into selected classes using first model(s) associated with the respective geographical regions. Security actions are selected from a plurality of possible security actions using second model(s) associated with the respective geographical regions. A security recommendation regarding the security alert is generated. The security recommendation includes representations of the sets of designated security incidents, the selected classes, and/or the security actions.
What exactly they claim (claim 1)
1. A system comprising: a processor system; and a memory that stores computer-executable instructions that are executable by the processor system to at least: receive a security alert regarding an identified security incident associated with an entity; classify the identified security incident into selected classes for respective geographical regions, the selected classes determined from a plurality of classes by applying a first embedding of the identified security incident to first models that are trained to map sets of second embeddings of sets of historical security incidents to corresponding sets of classes of the plurality of classes, the plurality of classes corresponding to at least one of validity of security concerns or maliciousness of actions that result in the security concerns; select security actions to be performed with regard to the entity in the respective geographical regions by applying a third embedding of the security alert to second models that are trained to map sets of fourth embeddings of sets of historical security alerts associated with the respective geographical regions to corresponding sets of security actions; and generate a security recommendation regarding the security alert, the security recommendation comprising a representation of the selected classes and a representation of the security actions.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- Geographically diversified embedding-based guided response to a security alert
- Patent number
- US12737460B2
- Application number
- 18930985
- Filed
- Oct 29, 2024
- Granted
- Sep 15, 2026
- Inventors
- 4
- Claims
- 22
Classified under
G06F 21/554 Physics & computingG06F 2221/034 Physics & computingMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.