DETAILED ACTION
This action is in response to the Applicant Response filed 28 April 2026 for application 17/226,908 filed 09 April 2021.
Claim(s) 1, 12-17, 19-20 is/are currently amended.
Claim(s) 24 is/are new.
Claim(s) 6-7, 11, 18 is/are cancelled.
Claim(s) 1-5, 8-10, 12-17, 19-24 is/are pending.
Claim(s) 1-5, 8-10, 12-17, 19-24 is/are rejected.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 28 April 2026 has been entered.
Response to Arguments
Applicant’s arguments regarding the 35 U.S.C. 102 and/or 35 U.S.C. 103 rejections of the claims are based on the newly amended subject matter. All arguments are addressed in the 35 U.S.C. 102 and/or 35 U.S.C. 103 rejections of the claims below.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-5, 8-10, 12-17, 19-24 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1, 19-20 recites recent network traffic volume data which is a relative term which renders the claim indefinite. The term “recent” is not defined by the claim, the specification does not provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would not be reasonably apprised of the scope of the invention. Clarification or correction is required.
Examiner’s Note: For the purposes of examination, the claim will be interpreted as if “recent” is not recited in the claim.
Claims 2-5, 8-10, 12-17, 21-24 are rejected under 35 U.S.C. 112(b) due to their dependence, either directly or indirectly, on claim 1, 19-20.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 1-5, 8, 12-17, 19-24 is/are rejected under 35 U.S.C. 103 as being unpatentable over (Nookula et al., U.S. Pat. No. 11,677,634 B1 – Selecting and Deploying Models Based on Sensor Availability, hereinafter referred to as “Nookula”) in view of Groot, Samuel (US 2022/0210043 A1 – Configurable Network Traffic Parser, hereinafter referred to as “Groot”).
Regarding claim 1 (Currently Amended), Nookula teaches a method comprising:
receiving, by a processing system including at least one processor (Nookula, col. 7:34-42 – teaches hub device [processing system] with processor; see also Nookula, Fig. 3) deployed in a communication network (Nookula, col. 2:17-48 – teaches communication network), data to be provided to a network intrusion detection application (Nookula, col. 4:21-24 - teaches receiving sensor data for processing; Nookula, col. 8:24-28 - teaches receiving changed sensor data, either from removed sensors or new sensors; see also Nookula, Fig. 5; [While Nookula does not explicitly teach a network intrusion detection, the combination with the network intrusion system of Groot teaches the limitation.]) using a scoring model for calculating a score (Nookula, col. 3: 22-45 - teaches processing sensor data using a scoring model) indicating a likelihood of a network intrusion associated with a communication session (Nookula, col. 3: 22-45 – teaches a probabilistic output [While Nookula does not explicitly teach a network intrusion detection, the combination with the network intrusion system of Groot teaches the limitation.]) …;
determining, by the processing system, that the data is incompatible with a current feature set of the scoring model applied by the network intrusion detection application (Nookula, col. 8:32-43 - teaches determining that the model feature set is incompatible with the input data; see also Nookula, col. 6:28-39 - teaches feature set of models; Nookula, Fig. 2; [While Nookula does not explicitly teach a network intrusion detection, the combination with the network intrusion system of Groot teaches the limitation.]), wherein the determining comprises determining at least one of: that the current feature set fails to include a first feature associated with a first category of data included in the data (Nookula, col. 6:28-34 - teaches each sensor provides a category of data; Nookula, col. 8:24-28 - teaches adding a sensor and the feature set does not provide for that category of data; see also, Nookula, col. 2:26-32; Nookula, Fig. 2), or that the current feature set includes a second feature associated with a second category of data that is missing in the data (Nookula, col. 6:28-34 - teaches each sensor provides a category of data; Nookula, col. 8:24-28 - teaches removing a sensor [incomplete data]; see also, Nookula, col. 2:26-32; Nookula, Fig. 2);
selecting, by the processing system, a next best model of features in response to the determining that the data is incompatible with the current feature set (Nookula, col. 8:43-48 - teaches the receiving a new model with a new feature set that is best suited for the changed input data selected from the set of available models; see also Nookula, col. 6:34-39 - teaches selecting a model which is most compatible and most suitable [next best] based on the model feature sets; Nookula, Fig. 5), wherein the next best model is selected in accordance with a ranking of a plurality of models (Nookula, col. 8:43-48 - teaches the receiving a new model with a new feature set that is best suited for the changed input data selected from the set of available models; see also Nookula, col. 6:34-39 - teaches selecting a model which is most compatible and most suitable [next best] based on the model feature sets; Nookula, Fig. 5 [Selecting the next bast based on compatibility/suitability means ranking based on compatibility/suitability]), wherein the processing system determines the ranking based upon accuracies of the plurality of models in accordance with differences between a known output associated with a known data set and respective outputs of the pluralities of models in response to the known data set (Nookula, col. 8:43-48 - teaches the receiving a new model with a new feature set that is best suited for the changed input data selected from the set of available models; see also Nookula, col. 6:34-39 - teaches selecting a model which is most compatible and most suitable [highest ranking] based on the model feature sets; Nookula, col. 10:13-21 – teaches ranking models by accuracy or speed; Nookula, Fig. 5), and wherein the processing system implements the plurality of models and applies the known data set to the plurality of models to generate the respective outputs (Nookula, col. 8:43-48 - teaches the receiving a new model with a new feature set that is best suited for the changed input data selected from the set of available models; see also Nookula, col. 6:34-39 - teaches selecting a model which is most compatible and most suitable [highest ranking] based on the model feature sets; Nookula, col. 10:13-21 – teaches ranking models by accuracy or speed; Nookula, Fig. 5), wherein the plurality of models comprises a plurality of machine learning models (Nookula, col.2:57-col. 3:2 – teaches machine learning models), wherein the next best model comprises a highest ranked model of the plurality of models (Nookula, col. 8:43-48 - teaches the receiving a new model with a new feature set that is best suited for the changed input data selected from the set of available models; see also Nookula, col. 6:34-39 - teaches selecting a model which is most compatible and most suitable [highest ranking] based on the model feature sets; Nookula, col. 10:13-21 – teaches ranking models by accuracy or speed; Nookula, Fig. 5), and wherein the ranking of the plurality of models is updated on an ongoing basis (Nookula, col. 8:23-51 – teaches continuously checking for new sensors and selecting new models based on which is most compatible and most suitable [highest ranking] based on the model feature sets; see also Nookula, Figs. 5-6);
executing, by the processing system, the scoring model of the network intrusion detection application to calculate the score with the data and the features of the next best model (Nookula, col. 8:48-51 – teaches processing data with the new next best model; see also Nookula, col. 3:22-45 – teaches processing data with a scoring model; [While Nookula does not explicitly teach a network intrusion detection, the combination with the network intrusion system of Groot teaches the limitation.]);
generating, by the processing system, an output in accordance with the score (Nookula, col. 4:25-43 – teaches generating an output in accordance with the score of the scoring model) …; and
executing, by the processing system, at least one remedial action in response to the output (Nookula, col. 4:25-43 – teaches generating a remedial action in response to the output of the model) ...
While Nookula teaches the method of the recited in the claim, Nookula does not explicitly teach that the method is applied to a network intrusion detection system. Further, Nookula does not explicitly teach wherein the data includes: network traffic volume data, communication session setup data, and communication session authentication data.
Groot teaches
receiving, by a processing system including at least one processor deployed in a communication network, data to be provided to a network intrusion detection application (Groot, [0033], [0049] – teaches a network intrusion detection system which received network traffic data) … wherein the data includes: recent network traffic volume data, communication session setup data of the communication session, and communication session authentication data of the communication session (Groot [0033]-[0035] - teaches network traffic data including analysis, communication and authentication of various protocols and applications);
executing, by the processing system, the scoring model of the network intrusion detection application to calculate the score with the data and the features of the next best model (Groot, [0100]-[0103] – teaches model selection for a network intrusion detection system based on a score generated by ma classification model to identify an intrusion event);
generating, by the processing system, an output in accordance with the score, wherein the score is indicative of a network intrusion event (Groot, [0100]-[0103] – teaches model selection for a network intrusion detection system based on a score generated by ma classification model to identify an intrusion event); and
executing, by the processing system, at least one remedial action in response to the output, wherein the at least one remedial action comprises blocking the communication session in the communication network (Groot, [0019]-[0020] – teaches using the network intrusion system to perform a remedial action including blocking communications across the network).
It would have been obvious to one of ordinary skill in the art before the filing date of the claimed invention to modify Nookula with the teachings of Groot in order to parse network traffic more quickly and efficiently in the field of model selection based on incompatible data in a network intrusion detection system (Groot, [0012] – “Accordingly, described herein in various implementations are systems, methods, techniques, and related technologies, which enable a parsing engine (e.g., a parser) to parse network traffic more quickly, efficiently, or a combination thereof. Various processing engines may perform different actions, function, operations, etc., based on field values of protocol fields (e.g., portions of network traffic, such as portions of headers). For example, a processing engine may classify an entity or a device based on a protocol field of the network traffic. In another example, a processing engine may perform various actions, such as security actions based on a protocol field of the network traffic. The processing engines may register with the parsing engine to indicate which protocol portions (e.g., fields, portions thereof, etc.) are requested by the processing engines.”).
Regarding claim 2 (Original), Nookula in view of Groot teaches all of the limitations of the method of claim 1 as noted above. Nookula further teaches wherein the determining that the data is incompatible with the current feature set comprises determining that the data is incomplete (Nookula, col. 8:24-28 - teaches removing a sensor [incomplete data]; see also, Nookula, col. 2:26-32).
It would have been obvious to one of ordinary skill in the art before the filing data of the claimed invention to combine the teachings of Nookula and Groot for the same reasons as disclosed in claim 1 above.
Regarding claim 3 (Original), Nookula in view of Groot teaches all of the limitations of the method of claim 2 as noted above. Nookula further teaches wherein the determining that the data is incomplete comprises identifying missing data within a sequence of the data (Nookula, col. 5:1-19 - teaches receiving time series data at the sensors; Nookula, col. 8:24-28 - teaches removing a sensor [missing time series data due to removed sensor]).
It would have been obvious to one of ordinary skill in the art before the filing data of the claimed invention to combine the teachings of Nookula and Groot for the same reasons as disclosed in claim 2 above.
Regarding claim 4 (Previously Presented), Nookula in view of Groot teaches all of the limitations of the method of claim 2 as noted above. Nookula further teaches wherein the determining that the data is incomplete comprises identifying that the second category of data is missing in the data (Nookula, col. 6:28-34 - teaches each sensor provides a category of data; Nookula, col. 8:24-28 - teaches removing a sensor [incomplete data]; see also, Nookula, col. 2:26-32; Nookula, Fig. 2).
It would have been obvious to one of ordinary skill in the art before the filing data of the claimed invention to combine the teachings of Nookula and Groot for the same reasons as disclosed in claim 2 above.
Regarding claim 5 (Original), Nookula in view of Groot teaches all of the limitations of the method of claim 1 as noted above. Nookula further teaches wherein the determining that the data is incompatible with the current feature set comprises determining that the data is outdated (Nookula, col. 8:24-31 – teaches determining, including after a given time period, that the sensors have changed and therefore the data is outdated).
It would have been obvious to one of ordinary skill in the art before the filing data of the claimed invention to combine the teachings of Nookula and Groot for the same reasons as disclosed in claim 1 above.
Regarding claim 8 (Previously Presented), Nookula in view of Groot teaches all of the limitations of the method of claim 1 as noted above. Nookula further teaches wherein the determining that the current feature set includes the second feature associated with the second category of data that is missing in the data comprises:
comparing, by the processing system, the current feature set to an expected feature set (Nookula, col. 8:32-51 – determining that the sensors have changed and that the feature set for the current model does not match the feature set of the expected model); and
determining, by the processing system, that the current feature set does not match the expected feature set (Nookula, col. 8:32-51 – determining that the sensors have changed and that the feature set for the current model does not match the feature set of the expected model).
It would have been obvious to one of ordinary skill in the art before the filing data of the claimed invention to combine the teachings of Nookula and Groot for the same reasons as disclosed in claim 1 above.
Regarding claim 12 (Currently Amended), Nookula in view of Groot teaches all of the limitations of the method of claim 1 as noted above. Nookula further teaches wherein the ranking of the plurality of models is continuously updated (Nookula, col. 8:23-51 – teaches determining the best suited model for each request [continuously] by the hub device).
It would have been obvious to one of ordinary skill in the art before the filing data of the claimed invention to combine the teachings of Nookula and Groot for the same reasons as disclosed in claim 1 above.
Regarding claim 13 (Currently Amended), Nookula in view of Groot teaches all of the limitations of the method of claim 1 as noted above. Nookula further teaches wherein the ranking of the plurality of models is updated based on a current time (Nookula, col. 8:23-51 – teaches determining the best suited model for each request [continuously] by the hub device and/or after a threshold period of time).
It would have been obvious to one of ordinary skill in the art before the filing data of the claimed invention to combine the teachings of Nookula and Groot for the same reasons as disclosed in claim 1 above.
Regarding claim 14 (Currently Amended), Nookula in view of Groot teaches all of the limitations of the method of claim 1 as noted above. Nookula further teaches wherein the ranking of the plurality of models is updated based on at least one change to a weighting of different categories of data included in the data (Nookula, col. 6:28-39 - teaches selecting a model which is most compatible and most suitable [ranking] based on the sensor availability [weighting of data categories]).
It would have been obvious to one of ordinary skill in the art before the filing data of the claimed invention to combine the teachings of Nookula and Groot for the same reasons as disclosed in claim 1 above.
Regarding claim 15 (Currently Amended), Nookula in view of Groot teaches all of the limitations of the method of claim 1 as noted above. Nookula further teaches wherein the ranking of the plurality of models is updated based on at least one change to a cost to execute the scoring model (Nookula, col. 5:20-31 - teaches model descriptors including accuracy, speed and model size; Nookula, col. 6:34-39 - teaches selecting a model which is most compatible and most suitable [ranking] based on the model feature sets).
It would have been obvious to one of ordinary skill in the art before the filing data of the claimed invention to combine the teachings of Nookula and Groot for the same reasons as disclosed in claim 1 above.
Regarding claim 16 (Currently Amended), Nookula in view of Groot teaches all of the limitations of the method of claim 1 as noted above. Nookula further teaches wherein the ranking of the plurality of models is updated based on a re-computation of the plurality of models with a change in a number of features associated with the plurality of models (Nookula, col. 8:23-51 – teaches determining the best suited model for each request by the hub device when the sensors change [re-computation after a change in features]).
It would have been obvious to one of ordinary skill in the art before the filing data of the claimed invention to combine the teachings of Nookula and Groot for the same reasons as disclosed in claim 1 above.
Regarding claim 17 (Currently Amended), Nookula in view of Groot teaches all of the limitations of the method of claim 12 as noted above. Nookula further teaches wherein the ranking of the plurality of models is updated based on a set of pre-computed models for different combinations of features (Nookula, col. 10:37-52 - teaches selecting models from a data store of for deployment to a client device; see also Nookula, col. 5:32-46).
It would have been obvious to one of ordinary skill in the art before the filing data of the claimed invention to combine the teachings of Nookula and Groot for the same reasons as disclosed in claim 1 above.
Regarding claim 19 (Currently Amended), it is the computer-readable medium embodiment of claim 1 with similar limitations to claim 1 and is rejected using the same reasoning found in claim 1. Nookula further teaches a non-transitory computer-readable medium storing instructions which, when executed by a processing system including at least one processor, cause the processing system to perform operations (Nookula, col. 12:52-66 - teaches a computer system for processing steps which includes processor and memory; Nookula, col. 13:18-19 - teaches memory storing instruction executed by processor; see also Nookula, col. 7: 34-42; Nookula, Figs. 3, 9) ...
It would have been obvious to one of ordinary skill in the art before the filing data of the claimed invention to combine the teachings of Nookula and Groot for the same reasons as disclosed in claim 1 above.
Regarding claim 20 (Currently Amended), it is the device embodiment of claim 1 with similar limitations to claim 1 and is rejected using the same reasoning found in claim 1. Nookula teaches a device comprising: a processing system including at least one processor; and a non-transitory computer-readable medium storing instructions which, when executed by the processing system, cause the processing system to perform operations (Nookula, col. 12:52-66 - teaches a computer system for processing steps which includes processor and memory; Nookula, col. 13:18-19 - teaches memory storing instruction executed by processor; see also Nookula, col. 7: 34-42; Nookula, Figs. 3, 9) ...
It would have been obvious to one of ordinary skill in the art before the filing data of the claimed invention to combine the teachings of Nookula and Groot for the same reasons as disclosed in claim 1 above.
Regarding claim 21 (Previously Presented), the rejection of claim 20 is incorporated herein. Further, the limitations in this claim are taught by Nookula in view of Groot for the reasons set forth in the rejection of claim 2.
Regarding claim 22 (Previously Presented), the rejection of claim 21 is incorporated herein. Further, the limitations in this claim are taught by Nookula in view of Groot for the reasons set forth in the rejection of claim 3.
Regarding claim 23 (Previously Presented), the rejection of claim 21 is incorporated herein. Further, the limitations in this claim are taught by Nookula in view of Groot for the reasons set forth in the rejection of claim 4.
Regarding claim 24 (New), the rejection of claim 20 is incorporated herein. Further, the limitations in this claim are taught by Nookula in view of Groot for the reasons set forth in the rejection of claim 4.
Claim(s) 9 is/are rejected under 35 U.S.C. 103 as being unpatentable over Nookula in view of Groot and further in view of Miranda et al. (US 2018/0357299 A1 – Identification and Management System for Log Entries, hereinafter referred to as “Miranda”).
Regarding claim 9 (Original), Nookula in view of Groot teaches all of the limitations of the method of claim 1 as noted above. However, Nookula in view of Groot does not explicitly teach communicating, by the processing system, with an external source of the data to verify that the data is complete or current.
Miranda teaches wherein the determining comprises:
communicating, by the processing system, with an external source of the data to verify that the data is complete or current (Miranda, [0180] – teaches external review of the data to determine if the data is incomplete or incorrect).
It would have been obvious to one of ordinary skill in the art before the filing date of the claimed invention to modify Nookula in view of Groot with the teachings of Miranda in order to better train models using complete/correct data in the field of machine learning training/inference (Miranda, [0180] – “If the open log entry ... is prioritized as determined by the priority gate ..., the prioritized log entry ... is provided to the verification engine ... to determine the accuracy of the categorization and otherwise perform quality control functions for the prioritized log entry... The verification engine ... may use rules, quality control, or external review via the interface ... to determine that the prioritized log entry is an unnecessary transaction and may be removed as an unnecessary transaction... For example, an outlier transaction, or a transaction with incomplete or incorrect data included therein may be identified as unnecessary. Alternatively, the verification engine ... may determine the prioritized open log entry ... is correct and may be identified as a closed log entry... Such open log entries ... that are verified and converted to a closed log entry ... may be provided to the statistical model building engine ... as verified transactions ... for use in further training the statistical model...”).
Claim(s) 10 is/are rejected under 35 U.S.C. 103 as being unpatentable over Nookula in view of Groot and further in view of Sghiouer, Kaoutar (US 2021/0201209 A1 – Method and System for Selecting a Learning Model from among a Plurality of Learning Models, hereinafter referred to as “Sghiouer”).
Regarding claim 10 (Previously Presented), Nookula in view of Groot teaches all of the limitations of the method of claim 1 as noted above. However, Nookula in view of Groot does not explicitly teach executing, by the processing system, the application to calculate the score with the data and the current feature set; and determining, by the processing system, that the score is outside an expected scoring range.
Sghiouer teaches wherein the determining further comprises:
executing, by the processing system, the scoring model to calculate the score with the data and the current feature set (Sghiouer, [0097] - teaches evaluating a machine learning model and replace it with a more suitable learning model; Sghiouer [0137]-[0138] - teaches evaluating the prediction model by comparing the performance indicators to thresholds; see also Sghiouer, [0098], [0103]-[0105], [0114]); and
determining, by the processing system, that the score is outside an expected scoring range (Sghiouer, [0097] - teaches evaluating a machine learning model and replace it with a more suitable learning model; Sghiouer [0139]-[0140] - teaches determining that the prediction model scores are less than threshold values and selects a new model; see also Sghiouer, [0098], [0103]-[0105], [0114]).
It would have been obvious to one of ordinary skill in the art before the filing date of the claimed invention to modify Nookula in view of Groot with the teachings of Sghiouer in order to create reactive learning models that can change based on input changes over time to avoid loss of predictive performance affecting responsiveness and sensitivity of control processes in the field of training/selection of machine learning models (Sghiouer, [0095] – “In particular, machine learning is based on a multitude of data that can come from several different sources and can therefore be highly heterogeneous. Thus, with the methods of the prior art, it is common for a team of data scientists to be trained in data processing and set up data processing processes. Once this data is processed, it allows the training of a learning model. Nevertheless, when data sources are diverse and vary over time, the prior art methods are not reactive and can cause shutdowns of industrial processes. Indeed, when machine learning is used for industrial process control, any change in variables not taken into account by the learning model can lead to a decrease in the prediction performance thereof and thus affect the responsiveness of control processes or worse a lack of sensitivity.”).
Conclusion
Any inquiry concerning this communication or earlier communication from the examiner should be directed to MARSHALL WERNER whose telephone number is (469) 295-9143. The examiner can normally be reached on Monday – Thursday 7:30 AM – 4:30 PM ET.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kamran Afshar, can be reached at (571) 272-7796. The fax number for the organization where this application or proceeding is assigned is (571) 273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MARSHALL L WERNER/ Primary Examiner, Art Unit 2125
Prosecution Insights