Microsoft patents security tool that links hidden attack patterns
Microsoft has filed a patent for a security system that connects separate security alerts even when they do not share a direct link in a standard security map. It uses a model to find indirect attack paths, grouping these alerts into a single incident and displaying the overall security status of the network.
In the filing’s own words
Methods, systems, and computer storage media for providing security incident management using a latent-context alert correlation engine in a security management system. Security incident management is provided using the latent-context alert correlation engine that is operationally integrated into the security management system. In operation, first security data of a first alert and second security data of a second alert are accessed. The first alert and the second alert do not share a common entity identifiable in a security graph. Using the first security data and the second security data, a determination is made that the first alert is connected to the second alert based on a latent-context connection. The latent-context connection is a known attack path connection that indirectly connects alerts. Based on determining that the first alert is connected to the second alert, a security incident is generated for the alert. A notification comprising the security incident is communicated.
What exactly they claim (claim 1)
1. A computerized system comprising: one or more computer processors; and computer memory storing computer-useable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform operations, the operations comprising: accessing first security data of a first alert and second security data of a second alert, wherein the first alert and the second alert are associated with a computing environment; determining that the first alert is not connected to the second alert based on the first alert and the second alert not having a common entity identified in a security graph; using the first security data, the second security data, and a latent-context alert correlation graph model, determining that the first alert is connected to the second alert based on a latent-context connection, wherein the latent-context connection is a derived attack-path-based connection that maps security data in a latent-context alert correlation graph associated with the latent-context alert graph model; based on determining that the first alert is connected to the second alert, generating a security incident associated with the first alert and the second alert; receiving a request for a security posture of the computing environment; and communicating a security posture visualization associated with the computing environment, wherein the security posture visualization comprises the security incident.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- LATENT-CONTEXT ALERT CORRELATION ENGINE IN A SECURITY MANAGEMENT SYSTEM
- Publication number
- US20260310790A1
- Application number
- 19707872
- Filed
- Jun 15, 2026
- Published
- Oct 8, 2026
- Inventors
- 3
- Claims
- 20
Classified under
G06F 21/57 Physics & computingG06F 2221/034 Physics & computingMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.