Google Patents an AI That Maps Internet Threats Like a Social Network
Most security systems judge a suspicious website on its own. Google's new patent takes a wider view, scoring threats by looking at their neighbors in a web of connected indicators, the same way fraud detectors map criminal networks.
How Google's threat-scoring graph actually works
A security camera stares at an empty hallway all night, and it only flags motion it can directly see. Your company's security software often works the same way: it checks a suspicious web address against a list of known bad actors and stops there.
Google's patent describes a different approach. Instead of judging each suspicious indicator (a domain name, an IP address, a server) in isolation, the system builds a map that connects related indicators to one another. If a domain you've never seen before is run by the same operator as a known malware host, that relationship gets factored in when scoring the new domain.
The system then weighs opinions from multiple security sources, giving more weight to sources with a proven track record, and combines all of that into a single threat score. Security teams get a number that reflects not just what one suspicious address has done, but what its entire neighborhood has done.
storing, at a compute device, a plurality of cyber-threat indicators as a plurality of nodes within a semantic graph; defining, at the compute device, one or more edges between the plurality of nodes based on one or more relationships specified by a protocol specification …
Translation: The system saves security threats as points on a web and connects them based on their shared rules.
How the semantic graph propagates and weights threat scores
The patent describes a machine learning pipeline built around what it calls a semantic graph, a data structure where each cyber-threat indicator (a domain, an IP address, a URL) is a node, and the connections between them are edges.
Those edges are defined by two kinds of relationships:
- Operational relationships: two domains registered under the same administrative owner, for example.
- Functional relationships: two services that communicate using the same network protocol, meaning they follow the same rulebook for how data is exchanged.
When the system needs to score an unknown indicator, it doesn't just look at that node in isolation. It propagates intermediate threat scores (think of ripples spreading across the graph) from neighboring nodes that already have verdicts from outside security feeds. Each outside verdict is then weighted based on how reliable that source has historically been, producing a "weighted vote." The trained ML model combines the propagated scores, the weighted votes, and any direct verdicts into one final threat score.
The result is sent to either a dashboard for human analysts or stored for automated response systems. The key technical claim is that the graph structure encodes domain-knowledge rules (protocol specs, admin boundaries) so the ML model doesn't have to learn those relationships from scratch.
Augmenting the verdicts associated with the IUE with verdicts associated with at least one related indicator having a defined relationship with the TUE.
Translation: It improves safety ratings by looking at the known history of connected security risks.
What this means for enterprise security tools
For security operations teams, this addresses a real and expensive problem: unknown indicators. A brand-new domain registered ten minutes ago has no history, so traditional blocklists give it a clean bill of health. By pulling in context from related infrastructure, Google's approach can flag that new domain as suspicious before it is used in an attack, potentially cutting response time from days to minutes.
Claim 1 of this patent is written broadly. It covers any system that stores threat indicators as nodes, links them by protocol or operational relationships, and then propagates scores through that graph using weighted source verdicts. That scope, if granted, could cover a wide range of commercial threat-intelligence platforms that use graph-based enrichment, and it positions Google's security products (Chronicle, VirusTotal, Mandiant) as the reference implementation of that idea. new Big Tech patents in the cybersecurity space often signal where cloud providers plan to entrench their enterprise offerings, and this filing points squarely at the threat-intelligence market.
This is the 21st Google patent we've tracked since May in our AI guardrails work, following one on spotting repeated queries and one on a gate for AI tool calls.
Claim 1 covers a specific loop: receive a threat indicator, collect outside opinions about it, pull in opinions about related indicators that share an administrative or functional connection, then feed everything into a machine-learning model to produce a score. The claim names no particular algorithm, no specific data format, only that sequence of steps. That sequence is broad enough to cover most professional threat-scoring systems built today.
Any tool that gathers outside judgments, borrows context from related indicators, and runs the combined picture through a machine-learning model could fall inside this claim. Google controls Mandiant, VirusTotal, and Chronicle, three services that do exactly this kind of work and are currently being merged into one platform.
A granted patent on this architecture hands Google a legal instrument over a workflow that sits at the center of the security industry.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
4 drawing sheets from US 2026/0254832 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →