Microsoft patents multi-layer system to flag high-risk security anomalies
Microsoft describes a security system that uses three different methods to scan large amounts of data for unusual activity. It combines the results from these methods into a single list, marking events as high risk only if all three methods flag them, to help security teams focus on the most serious threats.
In the filing’s own words
Multi-layer anomaly detection identifies and issues alerts to focus limited resources on the most concerning activities detected in voluminous data. A multi-layer anomaly detector includes a clusterer, a forecaster, and a statistics generator to respectively generate a first, second, and third anomaly lists for input data indicating voluminous events relative to one or more domains, such as access to computing devices; access to real estate; or financial transactions. An ensemble detector may generate an ensemble anomaly list indicating a subset of the voluminous events based on the first, second, and third anomaly lists. The lists may indicate anomaly (e.g., security risk) scores. The ensemble anomaly list may combine the anomaly (e.g., risk) scores in the first, second, and third anomaly lists. An identifier may generate an alert for the subset of events, e.g., with relative security risk scores for the relevant individuals, entities, and/or events.
What exactly they claim (claim 1)
1. A multi-layer anomaly detector system comprising: a processor; and a memory device that stores program code configured to be executed by the processor, the program code comprising: a first type anomaly detector configured to generate a first anomaly list based on input data, the first anomaly list comprising at least one first type anomaly risk; a second type anomaly detector configured to generate a second anomaly list based on the input data, the second anomaly list comprising at least one second type anomaly risk; a third type anomaly detector configured to generate a third anomaly list based on the input data, the third anomaly list comprising at least one third type anomaly risk, the first, the second, and the third type anomaly detectors being different anomaly detector types; an ensemble detector configured to generate an ensemble anomaly list based on the first, second, and third anomaly lists, the ensemble anomaly list classifying a non-overlapping anomaly risk appearing in one list of the first, second, or third anomaly lists as low risk, an overlapping anomaly risk appearing in two lists of the first, second, or third anomaly lists as medium risk, and an overlapping anomaly list appearing in all three of the first, second, and third anomaly lists as high risk; and a remediator configured to perform a remedial action that resolves at least one of the first type anomaly risk, the second type anomaly risk, or the third type anomaly risk.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- Multi-layer anomaly detector
- Patent number
- US12744803B2
- Application number
- 18512867
- Filed
- Nov 17, 2023
- Granted
- Sep 22, 2026
- Inventors
- 1
- Claims
- 20
Classified under
H04L 63/1425 Electricity & electronicsG06F 21/55 Physics & computingG06N 20/20 Physics & computingMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.