Microsoft patents method to match new security threats to past incidents
This patent describes a system that compares new security alerts to previous ones to find matches. It uses mathematical shortcuts called hashes and vectors to quickly identify similar threats without checking every detail.
In the filing’s own words
Described are systems and methods for measuring the similarity of security alerts, security incidents, or other complex data structures at scale using machine-learned signature vectors suitable for efficient similarity-based filtering in conjunction with hashes of the security alerts for more detailed comparisons. In some embodiments, similarity measurements between security incidents are used to base the processing of a current security incident on similar prior security incidents.
What exactly they claim (claim 1)
1. A computer-implemented method comprising: detecting, in a computer network, a first security incident comprising constituent first security alerts; determining first locality-sensitive hashes for the first security alerts based on data associated with the first security alerts; generating alert vectors for the first security alerts based on data associated with the first security alerts; assigning the alert vectors to alert clusters based on learned cluster centroids of the alert clusters; determining alert counts of the first security alerts for the alert clusters; determining similarities between the first security incident and second security incidents comprising constituent second security alerts, the similarities based on; (i) a first incident signature vector comprising the alert counts of the first security alerts for the alert clusters and second incident signature vectors comprising the alert counts of the second security alerts for the alert clusters, and (ii) similarities between the first locality-sensitive hashes and second locality-sensitive hashes computed for the second security alerts; identifying among the second security incidents, based on the similarities, at least one similar second security incident; and processing the first security incident based at least in part on the at least one similar second security incident.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- Identifying similarities in complex objects at scale
- Patent number
- US12756727B2
- Application number
- 18400987
- Filed
- Dec 29, 2023
- Granted
- Oct 6, 2026
- Inventors
- 6
- Claims
- 20
Classified under
H04L 63/1425 Electricity & electronicsH04L 63/1441 Electricity & electronicsMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.