National Security

Defensive Cyber Operations

The capacity to defend national networks and systems: detect, withstand, respond and recover, across military, government and critical services. One of the capabilities of Cyber & Electromagnetic Operations.

International families: 16k2015 to 2024
Leading country: United States3.0× the next
All families: 81khome filings included
Over five years: Steady2020 to 2024 against the five before

Year by year

Patent families by country of origin and the year of the earliest filing, 2000 to 2025; 2025 is a part year, still filling in. International families are those for which protection was sought beyond one country.

Volume

International patent families in the capability, by the year of the earliest filing.

Source: Global Institute for National Capability (GINC), 2026. Underlying patents from 107 patent offices, IFI CLAIMS and Google

Share by country

Each country's share of the year's international families, in per cent: the capability's five largest countries of origin, 2015 to 2024, and the rest of the world.

Source: Global Institute for National Capability (GINC), 2026. Underlying patents from 107 patent offices, IFI CLAIMS and Google

Country leaderboard

International patent families, 2015 to 2024, by country of origin. Growth compares the latest five full years with the five before.

Ten largest

United States

China

Japan

South Korea

Germany

United Kingdom

Israel

France

Russia

Sweden

5,863

1,954

1,881

1,128

878

540

459

445

297

282


1	United States	5,863	37.3%	0.9×	18,553
2	China	1,954	12.4%	1.1×	48,316
3	Japan	1,881	12.0%	0.9×	2,724
4	South Korea	1,128	7.2%	1.3×	4,302
5	Germany	878	5.6%	1.2×	1,183
6	United Kingdom	540	3.4%	1.0×	823
7	Israel	459	2.9%	1.0×	955
8	France	445	2.8%	0.9×	531
9	Russia	297	1.9%	0.3×	460
10	Sweden	282	1.8%	1.8×	295
11	Canada	265	1.7%	1.0×	402
12	Taiwan	237	1.5%	1.2×	373
13	Finland	215	1.4%	0.7×	234
14	Switzerland	170	1.1%	1.5×	304
15	Singapore	142	0.9%	1.5×	192
16	Netherlands	140	0.9%	1.5×	183
17	India	116	0.7%	1.8×	262
18	Cayman Islands	98	0.6%	0.1×	107
19	Ireland	88	0.6%	0.5×	139
20	Saudi Arabia	68	0.4%	1.3×	138
21	Italy	56	0.4%	2.3×	91
22	Türkiye	51	0.3%	3.3×	61
23	Australia	49	0.3%	1.0×	78
24	Austria	30	0.2%	1.3×	33
25	Spain	26	0.2%	0.7×	27
26	Hong Kong	23	0.1%	0.2×	37
27	Czechia	16	0.1%	0.2×	67
28	Denmark	15	0.1%	2.8×	16
29	Norway	15	0.1%	0.9×	16
30	Belgium	14	0.1%	0.6×	15
31	Poland	13	0.1%	1.2×	19
32	Portugal	13	0.1%	1.6×	16
33	Luxembourg	11	0.1%	0.4×	11
34	Brazil	9	0.1%	0.3×	18
35	New Zealand	8	0.1%	0.6×	11
36	Malaysia	7	0.0%	0.8×	7
37	South Africa	4	0.0%	1.0×	5
38	Hungary	4	0.0%	1.0×	4
39	Mexico	1	0.0%	–	3

Applicants

The largest applicants by international patent families, 2015 to 2024: across the world, then within each of the five countries with the most families in Defensive Cyber Operations. Names are as held in the source and are not consolidated across subsidiaries.

Global

15,717 international families

MICROSOFT TECHNOLOGY LICENSING LLC · United States

HUAWEI TECH CO LTD · China

NEC CORP · Japan

NIPPON TELEGRAPH & TELEPHONE · Japan

BOSCH GMBH ROBERT · Germany

AO Kaspersky Lab · Russia

672

464

344

284

254

243

United States

5,863 international families

MICROSOFT TECHNOLOGY LICENSING LLC

INTEL CORP

IBM

CISCO TECH INC

QUALCOMM INC

GOOGLE LLC

669

232

213

201

166

128

China

1,954 international families

HUAWEI TECH CO LTD

PING AN TECH SHENZHEN CO LTD

ZTE CORP

TENCENT TECH SHENZHEN CO LTD

HUAWEI CLOUD COMPUTING TECH CO LTD

ALIPAY HANGZHOU INF TECH CO LTD

453

100

Japan

1,881 international families

NEC CORP

NIPPON TELEGRAPH & TELEPHONE

FUJITSU LTD

MITSUBISHI ELECTRIC CORP

HITACHI LTD

PANASONIC IP MAN CO LTD

300

284

152

135

113

South Korea

1,128 international families

SAMSUNG ELECTRONICS CO LTD

ELECTRONICS & TELECOMMUNICATIONS RES INST

KOREA INTERNET & SECURITY AGENCY

HYUNDAI MOTOR CO LTD

FOUNDATION SOONGSIL UNIV INDUSTRY COOPERATION

KIA CORP

1,399

Crosswalk

How Defensive Cyber Operations is matched to the patent classifications. The entries below were chosen for it; each stands for itself and everything beneath it in the scheme, 26 Cooperative entries in all. A patent family counts when any of its codes, in either scheme and at any office, falls under one of them. Codes since retired are placed under the entries that replaced them.

Entry	Title in the scheme	Why it is chosen	CPC codes	IPC codes	Documents
H04L63/14	Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic	Detecting and countering malicious network traffic	12	2	334,494
G06F21/55	Detecting local intrusion or implementing counter-measures	Intrusion detection and malware handling on computers	13	2	159,352
G06F21/577	Assessing vulnerabilities and evaluating computer system security	Assessing vulnerabilities of computer systems	1	none	39,710

CPC and IPC codes are the codes in use on patent documents, at any office, that fall under the entry. Documents is the larger of the two schemes' counts of documents carrying one of them. An entry with no IPC codes can be told apart only in the Cooperative scheme.

The Cooperative codes in use that count towards Defensive Cyber Operations: 26 codes on 533,556 documents. The full crosswalk is in the cpc-to-capability.csv download.

Code	Title	Under entry	How placed	Documents
H04L63/1416	Event detection, e.g. attack signature detection	H04L63/14	In the scheme	66,650
H04L63/1425	Traffic logging, e.g. anomaly detection	H04L63/14	In the scheme	62,132
H04L63/1441	Countermeasures against malicious traffic	H04L63/14	In the scheme	44,489
G06F21/577	Assessing vulnerabilities and evaluating computer system security	G06F21/577	In the scheme	39,710
H04L63/1433	Vulnerability analysis	H04L63/14	In the scheme	36,239
H04L63/1408	Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic	H04L63/14	In the scheme	35,750
G06F21/554	Detecting local intrusion or implementing counter-measures involving event detection and direct action	G06F21/55	In the scheme	33,224
G06F21/552	Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting	G06F21/55	In the scheme	25,514
G06F21/566	Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities	G06F21/55	In the scheme	24,116
H04L63/145	Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms	H04L63/14	In the scheme	20,939
G06F21/56	Computer malware detection or handling, e.g. anti-virus arrangements	G06F21/55	In the scheme	19,138
H04L63/1466	Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks	H04L63/14	In the scheme	19,125
H04L63/1458	Denial of Service	H04L63/14	In the scheme	18,037
G06F21/55	Detecting local intrusion or implementing counter-measures	G06F21/55	In the scheme	16,271
H04L63/1483	Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing	H04L63/14	In the scheme	11,725
H04L63/14	Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic	H04L63/14	In the scheme	10,617
G06F21/562	Static detection	G06F21/55	In the scheme	8,641
G06F21/563	Static detection by source code analysis	G06F21/55	In the scheme	7,399
H04L63/1491	Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment	H04L63/14	In the scheme	6,723
G06F21/564	Static detection by virus signature recognition	G06F21/55	In the scheme	5,037
G06F21/568	Computer malware detection or handling, e.g. anti-virus arrangements eliminating virus, restoring damaged files	G06F21/55	In the scheme	4,897
G06F21/556	Detecting local intrusion or implementing counter-measures involving covert channels, i.e. data leakage between processes	G06F21/55	In the scheme	4,473
G06F21/565	Static detection by checking file integrity	G06F21/55	In the scheme	4,290
G06F21/567	Computer malware detection or handling, e.g. anti-virus arrangements using dedicated hardware	G06F21/55	In the scheme	3,854
G06F21/561	Virus type analysis	G06F21/55	In the scheme	2,498
H04L63/1475	Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored	H04L63/14	In the scheme	2,068

Match: Through its tools

The classification names the equipment or technology the capability draws on, not the capability. The count says how much is being invented for it, not how well it is done. Overwhelmingly commercial cybersecurity, the same technology whoever defends the network; only G06F21/55 can be seen in International-only records, since the network entry there is the far broader H04L9/40, which was not used. The crosswalk is a first pass that nobody has reviewed.

Other capabilities in Cyber & Electromagnetic Operations

Offensive Cyber Operations
Electronic Warfare & Spectrum Operations