IBM Files Patent to Let Security Teams Ask for Data in Plain English
Every security product speaks its own strict query language. IBM's patent puts a graph in the middle, so you can ask in plain English and still get exact, rule-checked wording.
What IBM's plain-English security search does
Every security tool you might use to hunt for hackers has its own way of asking questions, and each one demands strict grammar. An analyst who wants to know which programs on a network contain a suspicious phrase has to learn that grammar, tool by tool.
IBM's patent application describes a go-between step. You type your request in everyday English. An AI model turns it into a graph, a simple map of boxes and arrows where each box is one step, such as pick the data source, filter for this text, or return the matching processes.
Then a traditional program, not the AI, translates that map into the exact wording the security tool needs and runs it. Because the final wording comes from fixed rules, the AI has less room to make things up.
… converting, by the processor set using a machine learning model, the natural language description of the cybersecurity task into a graph, wherein the graph is generated based on an interlingual query language that defines node types for the graph …
Translation: An AI turns plain text instructions into a structured map using a universal query language.
How IBM's graph step sits between you and the code
The system starts with a request written in everyday language, such as "search for all processes that have this text in their command line." A machine learning model, typically a large language model (an AI trained on huge amounts of text), converts it into a graph written in an interlingual query language. That is a shared in-between language the patent defines, built from the common building blocks of query languages like SQL, KQL and XQL.
Each box in the graph has a type, and the filing lists examples:
- DataSource: which data store to search
- Filter: the condition to match
- ProjectEntity: what kind of result to return
- Variable: a saved copy of the result for later investigation
A compiler (a program that translates one language into another) then turns the graph into the target query. It works in a deterministic way, meaning the same graph always produces the same query. It is paired with a mapping from a standard security data format (the filing names OCSF) to the specific platform. It can also check grammar, optimize the query, and enforce security rules, such as rejecting a step that creates a table when the environment forbids it.
The filing adds that the AI model can be prompt-tuned or fine-tuned (adjusted for the task) for the interlingual language, and that new query languages can be added later.
The processor set translates the graph to a cybersecurity query in the target query language using a compiler.
Translation: A specialized compiler converts that map into code a security platform can execute.
Why IBM's patent matters for security teams
Anyone who has watched a security team juggle several tools will see the appeal: you describe what you want, and the system writes the exact wording for whichever product you use. That could shorten the learning curve for newer analysts, and the built-in rule checks could keep a request from doing something your organization's setup forbids.
The patent office has approved this application, and once IBM pays the final fee it should be issued as a granted patent. The filing does not name an IBM product, so what shape this takes, if any, is unknown. The description mentions platforms for threat detection, event logging and threat hunting as the places it would run.
IBM's 400th filing in our IBM coverage since May follows sorting documents privately and guiding AI to better sources.
The problem is real. Security teams work with several products at once, and the filing itself points out that the variety in grammar across tools creates a heavy learning burden. Time spent looking up syntax is time not spent chasing an intruder.
The design fits the size of that problem. A fixed-rule translator placed after the AI limits the damage a made-up answer can do, and checks that block forbidden steps give a security team a safety net. Adding a new tool means updating the shared language instead of starting over.
The filing gives no accuracy numbers, so how well the AI handles vague or messy requests stays unproven. Still, a sensible design aimed at a daily annoyance earns a thumbs up.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time IBM patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
5 drawing sheets from US 2026/0320038 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in