A New Microsoft Patent Flags Suspicious Computer Connections by Checking Who Normally Talks to Whom
Microsoft's patent application tries to spot hackers moving between computers by asking one question: does this connection cross lines it normally wouldn't? The more lines it crosses, the louder the alarm.
What Microsoft's color-coded security map does
You're on the security team at a large company, and your screen shows thousands of connections between computers. Most are routine, like a developer's laptop talking to a test server. A few could be an attacker hopping from one machine to the next. Telling them apart is the hard part.
Microsoft's patent application sorts every computer, server and login into labeled groups, in several different ways at once. One sort might be by team, another by whether a system is for testing or for real customers, another by how many security protections are switched on. Think of each sort as a color.
Then it looks at a connection. If it starts in one color and ends in another, that's a little odd. If it does that in several sorts at once, it's a lot odder, and the system can send an alert or tighten protections on the machines involved.
Disclosed are techniques for distinguishing business legitimate connections between computing resources from suspicious connections. Making this distinction enables security threats to be mitigated without disrupting business processes.
Translation: The patent separates normal network traffic from threats so defenses do not block legitimate work.
How Microsoft scores a suspicious connection
The system starts with a resource graph, a map of a company's computing assets. Each node (a dot on the map) stands for a laptop, server, database, user login or access key. Each edge (a line between dots) stands for a connection, such as one machine being able to log into another. The filing treats each edge as a possible step an attacker could take while spreading through a network.
Next, several coloring systems label the dots. Each one sorts the same map by a different rule:
- Business unit or product group
- Development, test or production environment
- How many security features are turned on
- How many secrets (passwords, keys) a machine stores
A dot can have a color in several systems at once, and some dots get no color in some systems.
For any path through the map, the system checks whether the start and end dots have different colors in each coloring system. Each system gives the path a score. Scores can be weighted (the filing gives 70% for environment and 150% for business unit as examples) and then added into one total. If the total passes a cutoff, a security action fires.
That action can be an alert to an administrator, extra protection such as multi-factor authentication, or an automatic fix such as replacing an SSH key (a login credential) if nobody does it within 24 hours. The filing also describes grouping repeated crossings into patterns, so one common crossing gets one review instead of hundreds.
… computing a plurality of coloring system scores based on whether a beginning node of the path and an end node of the path have different colors in the plurality of coloring systems; aggregating the plurality of coloring system scores into an aggregate coloring system score; …
Translation: The system scores a connection path by checking if its start and end points belong to different functional groups.
What this means for Microsoft's security alerts
If this works as described, the people guarding a company's systems could get fewer pointless alerts and more useful ones. Because the system can name which sorts a connection crossed, an alert can say why it looks odd, such as a laptop with few protections reaching a locked-down accounting database. That makes it easier to act without shutting off connections the business relies on.
The filing describes a software idea for security teams rather than something you would see on your own devices, though the companies that hold your data could benefit. The examiner's first review rejected the claims as filed, which is routine at this stage and usually followed by amendments.
Filing 589 in our Microsoft coverage since May follows AI talking in numbers and tiny heat-spreading pumps, making this Microsoft's 589th application we've tracked.
The big cost here is that everything depends on labels. If a company tags its machines sloppily, or a machine has no tag in one of the sorts, the scoring has less to work with. The filing itself admits that any single sort is only a weak hint.
Real work also crosses lines all the time. A build machine that pushes software to a live server crosses the test-to-production line every day. A company will spend effort tuning weights and cutoffs to keep its own routine traffic from lighting up the board.
Still, the trade reads as a good one. Asking several simple questions at once costs little, produces alerts that come with a reason, and lets each company set its own bar. A single rigid rule would be cheaper to build and would be wrong more often.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Microsoft patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
9 drawing sheets from US 2026/0352697 A1 · click any drawing to enlarge
Show the other 1 sheets
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in