Microsoft Files Patent to Catch Server Hackers With Two AI Checks Instead of One
Microsoft's filing teaches a security system to ask two questions about a server at once: does this look like a known attack, and does it look unusual for this kind of machine? The answers merge into one score that can trigger an automatic response.
What Microsoft's two-AI threat score actually does
Most security tools judge a computer's activity in pieces. One check looks at who the machine is talking to, another watches which programs are running, and they rarely compare notes. Microsoft's filing says that isolation causes false alarms (harmless activity flagged as an attack) and misses (real attacks waved through).
The proposed fix bundles three views of a server into one picture: its network connections, what its programs are doing, and what kind of machine it is, such as a web server or a database server. Two AI models then examine that picture. One asks how closely it matches known attacks. The other asks how far it strays from what is normal for that kind of machine.
The two answers get merged into a single score. If the score is high enough, the system can act on its own, for example by alerting an administrator or shutting down a suspicious program.
… generate a threat score by analyzing relationships between the more than two vectors and first reference relationships associated with a known security threat using a supervised artificial intelligence (AI) model …
Translation: It runs a trained AI model to check if server data matches known hacker patterns.
How the known-attack and odd-behavior scores combine
The claims describe a system that builds a multi-vector representation of a machine: more than two vectors (lists of numbers, each summarizing one slice of telemetry, meaning the data a machine reports about itself). The main example uses three. One covers a network connection (addresses, ports, data volume, duration), one covers what a running program is doing (file, memory and network operations), and one covers the machine type (web server, database server, application server).
Two models then read the relationships between those vectors, so a pattern that looks harmless in one view can look suspicious in combination:
- A supervised model (trained on examples labeled as attack or not attack) produces a threat score showing how closely the pattern matches a known threat.
- An unsupervised model (trained on unlabeled data, so it finds patterns by itself) produces an anomaly score showing how far the pattern departs from normal for that machine type.
The scores are combined into one security score by sum, average, weights or other rules. One claim weights the threat score more heavily than the anomaly score. The filing says scoring can happen within 500, 100 or even 20 milliseconds.
When the score crosses a threshold, the system can alert an administrator, end the offending process, or add an IP address to a list of malicious addresses. The description says the models can be retrained every 24 hours on the latest 30 days of data. One claim covers machines running Linux.
Why Microsoft's server-defense filing matters
If you run a company's servers, the pitch is fewer false alarms, fewer missed attacks, and a faster automatic response. If you are an ordinary customer of a business hosted on those servers, the benefit is indirect: a break-in gets caught sooner. The description names Microsoft Defender and cloud security platforms as places this logic could live.
The filing says the approach could scale to millions of machines while using under 1% of a processor and under 100 megabytes of memory. Those are stated targets, with no test results given. The examiner's first review rejected the claims as filed, which is routine at this stage and usually followed by amendments.
Microsoft's 542nd filing in our Microsoft coverage since May joins earlier applications like the plain-language database search patent and the self-tightening headset in the set we track.
Security teams already face more alerts than they can read. Every false alarm burns analyst time, and every missed attack can turn into a breach. Microsoft's filing goes after both failures at once, which fits the size of the problem.
The method is modest: a known-attack check, a does-this-look-normal check, and a weighted blend. When the blend leans toward known threats, brand-new attacks depend on the weaker voice of the two. The filing offers no accuracy figures, so how much it improves on today's tools stays unproven.
Pairing a pattern matcher with a normal-behavior watcher is still a sound answer to a costly problem. Retraining on a rolling 30 days of data keeps the idea of normal current as servers change.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Microsoft patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
7 drawing sheets from US 2026/0332619 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in