Network Detection and Response Patents: Top Companies & Trends 2026
- 37.5% of all 1,334 records sit with just five assignees, so the field reads as concentrated at the top rather than fragmented.
- Filings peaked in 2022 at 161 and the 2021-2024 complete-year window shows a 30% decline, though 2025-2026 counts are still filling in as publications lag filing.
- H04L and G06F cover the field at 81.6% and 58.5% of records respectively, while G06V image/video recognition sits at just 1.6% — a narrow slice worth watching.
Filing growth compares 2021 (86 records) with 2024 (60) — a three-year span. 2024 is the most recent year we treat as complete: publication lags filing by roughly 18 months, so 2025 onwards are still filling in and any growth rate that ends there would understate the field. Top-5 share is the combined record count of the five largest assignees divided by all 1,334 records in scope (CR5), not by the ranked leaders only.
What this landscape covers
This landscape maps 1,334 published patent records filed against a search built around network intrusion detection, lateral movement and botnet detection, cross-referenced with behaviour baselining, alert correlation, packet capture and evasion-technique claims. The scope runs from 2015 through the 2026-07-31 data cut-off, capturing both the early behavioural-analytics wave and the more recent push toward AI-driven anomaly scoring. Patent families, not raw document counts, are the fairer unit here because they neutralise aggressive continuation filing and multi-jurisdiction duplication.
Filing activity is concentrated among a small group of security and networking vendors, with a long tail of single- or few-filing entrants behind them. The technology mix leans heavily on digital transmission and general data-processing claims, with AI-based computing classes now covering nearly a third of records — a sign that anomaly-scoring and behavioural-model claims have become a default layer rather than a differentiator on their own.
Let an AI agent run this analysis on your own technology
Pick a task. Every answer cites the patents behind it.
Filing trend and technology composition
The figures below are drawn directly from the 1,334 records in scope: annual filing counts by publication year and the IPC subclasses those records carry.
A 2022 peak followed by a cooling complete-year window
Publications rose from 92 in 2017 to a peak of 161 in 2022. Comparing the two most recent complete years available, 2021 (86) to 2024 (60), filings fell 30% — a real signal, but one that predates the still-filling-in 2025-2026 window, since publication typically lags filing by around 18 months.
Digital transmission and data processing dominate the class mix
H04L (digital information transmission) appears on 81.6% of the 1,334 records and G06F (electric digital data processing) on 58.5%, reflecting the network-layer and system-layer core of detection claims. G06N (AI-based computing) reaches 30.0% of records, up from a niche category to a mainstream claim element, while G06V (image/video recognition), G08B (signalling and alarms) and G06Q (business data processing) each sit under 7% — evidence of narrower, less-crowded claim territory.
Shares are the percentage of the 1,334 records in scope. A patent can carry several IPC classes, so the shares add up to more than 100%.
Go deeper on Network Detection and Response with Eureka
This page is one run against one query. Ask Eureka your own question about network detection and response and every answer comes back with the patent numbers behind it.
Try EurekaMost-cited records in this landscape
Network intrusion detection system (US20100251370A1)
A network intrusion detection system applied to detect and monitor network packets, deciding whether to load and operate detection rules according to current load. The system runs an alert correlation program alongside multiple detection rules and operation policies, checking packet contents against detection rules, assigning each rule a resource-consumption level, and categorising rules accordingly so processing can scale under load.Filed by Inventec Corporation; illustrates load-aware rule categorisation as an early approach to alert correlation at scale.
| # | Publication no. | Patent title | Citations |
|---|---|---|---|
| 1 | US9516053B1 | Network security threat detection by user/user-entity behavioral analysis | 1,293 |
| 2 | US20050210533A1 | Packet Sampling Flow-Based Detection of Network Intrusions | 549 |
| 3 | US7448084B1 | System and methods for detecting intrusions in a computer system by monitoring operating system registry acce… | 500 |
| 4 | US20090172815A1 | Method and apparatus for detecting malware infection | 461 |
| 5 | US10673880B1 | Anomaly detection to identify security threats | 452 |
| 6 | US20180219888A1 | Graph-Based Network Security Threat Detection Across Time and Entities | 450 |
| 7 | US20030105976A1 | Flow-based detection of network intrusions | 418 |
| 8 | US9565202B1 | System and method for detecting exfiltration content | 381 |
| 9 | US20140157405A1 | Cyber Behavior Analysis and Detection Method, System and Architecture | 372 |
| 10 | US20170063910A1 | Enterprise security graph | 370 |
Citation counts favour older records simply by virtue of being in circulation longer; treat them as a measure of influence on later filings, not of current commercial relevance.
Each row carries its publication number; clicking a row searches Eureka by that number.
Put your own technology through the same analysis
Eureka on the web
When you want the answer in the next five minutes.
The agent works the prompt against patents and technical literature, citing every source.
Run your analysis now →MCP server & REST API
When it has to run inside your own pipeline.
Patent search, landscape analysis and assignee resolution as MCP tools. Drop them into any agent framework, or call REST directly.
Browse MCP servers →What the numbers say about the field
Three patterns stand out once filing counts, IPC classes and citation data are read together.
Filing sits with a small group at the top
The top five assignees combined account for 37.5% of all 1,334 records in scope, and the top ten reach 45.4%. That leaves more than half the field distributed across a long tail of single- and few-filing entrants, which is where freedom-to-operate analysis needs the most manual review rather than reliance on the ranked leaders alone.
Complete-year filings are down, not the whole story
Comparing 2021 (86 filings) to 2024 (60 filings), the complete-year data shows a 30% decline. Recent-year assignee momentum data shows several established filers posting zero or sharply negative year-on-year counts in the latest year, but 2025-2026 figures are still filling in given the roughly 18-month publication lag, so this should be read as a plateau signal rather than a confirmed downtrend.
AI-based scoring is now a standard claim layer
Nearly a third of the 1,334 records carry a G06N classification alongside the H04L and G06F core, indicating that behavioural and anomaly-scoring models are increasingly bundled into network-layer detection claims rather than filed as standalone AI patents. Image/video recognition (G06V) and signalling/alarm classes (G08B) remain under 2% each, suggesting these adjacent branches are comparatively open.
Eureka can read the same corpus for gaps instead of for coverage: under-claimed branches adjacent to network detection and response, with the prior art for and against each one.
Who is filing, and where the gaps sit
The assignee ranking spans 100 companies drawn from the full 1,334-record dataset. Filing volume alone does not indicate technical superiority — it indicates where claim space is already occupied.
A single leader well ahead of the field
The top-ranked assignee holds 190 records, more than double the fifth-placed assignee's count of 28 and well over ten times the tenth-placed assignee's 17. That gap between first place and the rest of the ranked leaders is the sharpest concentration signal in the dataset.
Half the field sits outside the ranked leaders
With the top ten assignees combined accounting for 45.4% of all records, the majority of filings originate from entities outside that ranked group. That distribution matters for competitive monitoring: a single-assignee watch list will miss most of the field's actual filing activity.
Co-filing is rare and concentrated around one filer
Only five co-assignee pairs appear across the dataset, and the strongest pairs all involve the same corporate filer paired with different named inventors. Cross-company joint filing is effectively absent in this space, which is typical where detection algorithms are treated as core, single-owner IP rather than jointly developed standards.
| Assignee | Recent year | YoY |
|---|---|---|
| Microsoft Technology Licensing, LLC | 1 | -75% |
| LACEWORK INC | 0 | — |
| Splunk Inc. | 0 | — |
| DARKTRACE | 0 | — |
| Fortinet Inc. | 0 | -100% |
| Cisco Technology, Inc. | 0 | -100% |
| DARKTRACE HLDG LTD | 0 | -100% |
| Palo Alto Networks, Inc. | 0 | — |
Where to take this analysis
The figures above establish the shape of the field. Turning that into a filing or freedom-to-operate decision means going deeper on specific claims and assignees.
Map claim scope against the ranked leaders
Read the independent claims from assignees in the top ten against the specific sub-area you plan to file in, since 45.4% of records already sit with that group.
Explore assignee claims in EurekaPressure-test white space before drafting
Under-claimed IPC branches like G06V and G08B look open on volume alone, but a claim chart against the closest existing filings confirms whether the gap is real or just sparsely indexed.
Run a white space analysis in EurekaQuestions practitioners ask about this field
The dataset's assignee ranking shows a single leader with 190 records, well ahead of the fifth-placed assignee at 28 and the tenth-placed assignee at 17. The top five assignees combined hold 37.5% of all 1,334 records in scope, and the top ten hold 45.4%. That still leaves more than half the field distributed across a long tail of smaller filers, so a competitive watch list built only around the top names will miss a substantial share of activity.
Filings rose from 92 in 2017 to a peak of 161 in 2022. Comparing the two most recent complete years, 2021 (86) and 2024 (60), filings fell 30%. However, 2025 and 2026 counts are still incomplete because publication typically lags filing by roughly 18 months, so it is premature to call the field in decline based on the most recent two years alone; the safer read is a plateau after the 2022 peak.
H04L, digital information transmission, appears on 81.6% of the 1,334 records, and G06F, electric digital data processing, appears on 58.5%. G06N, AI-based computing, has grown to cover 30.0% of records, reflecting how anomaly-scoring and behavioural-model techniques have become a standard claim layer rather than a separate filing category. Narrower classes like G06V (image/video recognition) and G08B (signalling and alarms) sit under 2% each, marking comparatively open territory.
Based on IPC composition, the branches with the lowest record share relative to the core H04L/G06F claim space include image-based anomaly recognition (G06V, 1.6% of records), signalling and alarm integration (G08B, 1.2%), and business-process-aware threat scoring (G06Q, 2.2%). Low volume does not guarantee an open path, since some sparsity reflects indexing gaps rather than true absence of prior art, but these areas warrant a closer claim-by-claim check before assuming they are crowded.
Rarely. The dataset identifies only five co-assignee pairs across all 1,334 records, and the strongest of those pairs all involve the same corporate filer paired with different individual inventors rather than two separate companies. This suggests detection and response algorithms are generally treated as proprietary, single-owner IP in this field rather than developed through cross-company collaboration or joint ventures.
Research Network Detection and Response in depth with Eureka
Go past this page: query the whole network detection and response corpus yourself, in your own scope.
Every answer comes back with patent numbers you can open.
Disclaimer. This page is generated from Patsnap Eureka data drawn from a limited snapshot of global patent and scientific-literature records, and is provided for general information and reference only.
Patent data carries inherent limitations: recent filings (typically the most recent 18–24 months) are under-counted due to standard publication lag; counts may be reported at either a patent-family or a patent-record basis and are not always directly comparable; classification, applicant-name, and citation data may contain errors, duplicates, or omissions; and the underlying search query defines and constrains the scope shown. As a result, the analysis may be incomplete or inaccurate and may not reflect the full technology landscape.
Nothing on this page constitutes an exhaustive prior-art, novelty, freedom-to-operate, or validity search, nor does it constitute legal, financial, investment, or professional advice, and it should not be relied upon as such. Any patent, commercial, or strategic decision should be verified independently and reviewed with qualified patent, legal, and domain professionals. Patsnap makes no warranties, express or implied, as to the accuracy, completeness, or fitness for any particular purpose of the information presented.
Machine translation. Assignee and organisation names originally recorded in Chinese, Japanese or Korean have been rendered into English by an AI translation step so that the tables stay readable. These renderings are best-effort and may not match a company’s registered English name; the original name is what the underlying patent record carries, and it is what any Eureka query launched from this page uses.