/Patent Tracker
MicrosoftPatent applicationSecurity & privacyInterest 6/10

Microsoft patents crowd-sourced file blocking system

Microsoft describes a system that collects security reports from many different companies to identify dangerous files. It assigns a risk score to each file based on how many organizations flag it and how trustworthy those sources are. If the score gets too high, the system automatically sends a command to block that file from running on connected devices.

Why it mattersThis approach could help organizations stop new malware faster by sharing threat information in real-time rather than relying on a single company's detection tools.

In the filing’s own words

Systems and methods are provided for autonomous security control to prevent file execution based on incident classification crowdsourcing. Incident classification data is received from multiple computing devices, each associated with an entity identifier, and is aggregated to generate a risk profile for each identified file. A risk score is assigned and dynamically adjusted based on factors including classification volume, source reputation, and timing. If the score exceeds a threshold, an execution prevention policy is generated and transmitted to devices for enforcement. Prevention may occur locally or remotely, with actions varying by subscription level and threat type.

What exactly they claim (claim 1)

1. A computer-implemented method for autonomous security control to prevent file execution based on incident classification crowdsourcing, the method comprising: receiving, from multiple computing devices across different organizations, incident classification data corresponding to security events, the incident classification data comprising file identifiers and associated risk classifications; wherein a given file identifier identifies a given file; aggregating the received incident classification data; generating a risk profile for each identified file based on a number of independent risk classifications within the aggregated incident classification data indicating the file as malicious; assigning a risk score to each file, wherein the risk score is dynamically adjusted based on at least one of: a volume of independent organizations classifying the file as malicious, respective reputations of the organizations providing classifications, or a temporal distribution of classifications over time; determining whether the risk score for a given file exceeds a predefined execution prevention threshold; upon determining that the risk score exceeds the threshold for the given file, generating an execution prevention policy specifying that the given file should be blocked from execution across the computing devices in a participating organization; transmitting the execution prevention policy to the computing devices; and preventing execution of the given file on the computing devices subscribed to the security control system.

Facts

Company
Microsoft (Microsoft Technology Licensing, LLC)
Official title
SYSTEMS AND METHODS FOR AUTONOMOUS SECURITY CONTROL TO PREVENT FILE EXECUTION BASED ON INCIDENT CLASSIFICATION CROWDSOURCING
Publication number
US20260300487A1
Application number
19096443
Filed
Mar 31, 2025
Published
Oct 1, 2026
Inventors
2
Claims
20

Classified under

G06F 21/565 Physics & computingG06F 21/552 Physics & computing
Read the full filing (official PDF) ↗ Open in the Patent Tracker

More from Microsoft in Security & privacy

Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.