Remarks
Claims 1, 4, 5, 7-10, 13-15, 17-20, and 22-27 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 5/15/2026 has been entered.
Examiner’s Note
The subject matter being argued by Applicant and amended into the claims is extremely well-known machine learning subject matter. For example, Quinlan (Learning Decision Tree Classifiers) cited and used in Guia for Guia’s trees, published in 1996, decades before the instant application was filed, describes how decision trees, as well as voting with multiple trees works, including the thresholds, partitioning, and the like. One of ordinary skill in the art understands how decision trees work and focusing amendments and arguments on these extremely well-known aspects is not deemed to be the best route to move forward or to have compact prosecution.
The instant invention appears to use standard decision tree machine learning techniques to analyze network threats. If Applicant has made significant progress in the field of decision trees and machine learning, the Examiner respectfully requests that Applicant identify just what progress Applicant has made in this field.
Response to Arguments
Applicant's arguments filed 4/30/2026 have been fully considered but they are not persuasive.
With respect to Applicant’s allegations on page 10, it is noted that Siva Kumar is already cited as disclosing “Instructions for generating, by the machine learning model based on the second set of textual tokens in the new log record and the aggregate score for the new log record, an output that indicates whether the new log record is associated with a network attack” in Siva Kumar’s disclosure of generating an output, such as a score, normalized score, z-score, UI, combined score, label, or any other information that is output based on the above, for example. Thus, the primary reference already discloses generating an output by the machine learning model based on the aggregate score. Brabec adds in decision trees as the machine learning that already generates an output based on the aggregate score. Decision trees are traversed to a leaf node in order to determine the output, as is known in the art and as in the cited documents below. In response to applicant's arguments against the references individually, one cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986).
With respect to the argument section on page 11 and the top of page 12, it is unclear what Applicant is arguing. Applicant appears to be arguing that the decision trees of Guia do not include any splitting. However, as is known in the art (also please see Quinlin, cited below), decision trees include splits including thresholds of the value being used in the tree, which, in the combination, may include a TF-IDF score, which is widely used in machine learning. Guia discloses transforming text into a numerical value via TF-IDF. This is used in the classification process in the next section, which explicitly discusses tests at each node, including for each subtree, and states that “each possible outcome is associated with one of the subtrees”. These are the splits. This section also cites Quinlan, which discloses well known features of decision trees from the 1990s.
With respect to Applicant’s arguments in the section on page 12, the rejection itself fully defines the combination. Applicant’s allegations are simply incorrect, such as “the rejection identifies individual elements in isolation across different references without addressing the claimed requirement that these elements operate together in the specific manner recited…”. In fact, the rejection ties them all in together. For example, primary reference Siva Kumar is cited as disclosing machine learning computing an output based on an aggregate score. Brabec is cited as disclosing that the machine learning includes decision trees. Guia is cited as disclosing additional subject matter regarding the decision trees including use of TF-IDF in the decision trees. Below, Quinlan is also cited, since this is cited within Guia for decision trees as well. Applicant fails to cite anything that does not fit within the combination.
With respect to Applicant’s allegations in the section on pages 12-13, the combination would certainly not require replacing Siva Kumar’s approach with TF-IDF based scoring. To the contrary, this would be an additional means by which to score the sessions. Siva Kumar already discloses a number of different means, such as ratio of counts, conditional probability, log probability, etc., all used to calculate values for each of the detection models (e.g., paragraph 45). Thus, the entire basis of Applicant’s arguments in this section is incorrect. No further response is possible since everything in this section is based on Applicant’s erroneous belief that the combination would require replacing Siva Kumar’s approach with TF-IDF based scoring.
With respect to Applicant’s allegations in the section on pages 13-14, Applicant does not argue the actual motivational statements that were made in the rejection. For example, nowhere does Applicant even cite, let alone argue the following:
It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the machine learning techniques of Brabec into the lateral movement detection system of Siva Kumar in order to increase the ability to detect rare malware, to allow the system to appropriately weight each tree’s decision in a forest in order to detect whether or not an attack is present, and/or to increase security in the system.
…
It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the processing and classification techniques of Guia into the lateral movement detection system of Siva Kumar as modified by Brabec in order to improve results via pre-processing and text transformation, to provide additional mechanisms by which to classify data, to select the best performing mechanism, and/or to increase security in the system.
Since Applicant provides no argument against the actual motivations, it is clear that the motivations are proper. Moreover, as above, Applicant’s allegations are erroneous, such as Applicant’s allegation that “it requires restructuring Siva Kumar’s multi-model probabilistic scoring framework to employ TF-IDF based scoring, to define decision tree split criteria using such scoring, and to control traversal of the tree based on comparison to an aggregate score.” This restructuring is not necessary, as explained above, Siva Kumar allows for multiple different means already (in fact, Applicant already admits that Siva Kumar discloses “multi-model” scoring), so adding in a TF-IDF based machine learning model, such as in Guia, is very much within Siva Kumar’s abilities.
Drawings
The drawings are objected to under 37 CFR 1.83(a). The drawings must show every feature of the invention specified in the claims. Therefore, the entirety of new claim 27, as well as the subject matter related to the amendment to claim 19 (which includes subject matter present in other claims as well, such as splitting a tree “by selecting scores…” and the like) must be shown or the feature(s) canceled from the claim(s). No new matter should be entered.
Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in reply to the Office action to avoid abandonment of the application. Any amended replacement drawing sheet should include all of the figures appearing on the immediate prior version of the sheet, even if only one figure is being amended. The figure or figure number of an amended drawing should not be labeled as “amended.” If a drawing figure is to be canceled, the appropriate figure must be removed from the replacement sheet, and where necessary, the remaining figures must be renumbered and appropriate changes made to the brief description of the several views of the drawings for consistency. Additional replacement sheets may be necessary to show the renumbering of the remaining figures. Each drawing sheet submitted after the filing date of an application must be labeled in the top margin as either “Replacement Sheet” or “New Sheet” pursuant to 37 CFR 1.121(d). If the changes are not accepted by the examiner, the applicant will be notified and informed of any required corrective action in the next Office action. The objection to the drawings will not be held in abeyance.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims19 and 27 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
The application as originally filed does not appear to mention any partitioning, thresholds, or the like, and, thus, does not provide basis for “wherein the selected scores define threshold values associated with nodes of the decision tree for partitioning the training dataset” and “wherein traversing the decision tree includes, at one or more nodes of the decision tree, comparing the aggregate score to a corresponding threshold value defined by the selected scores to determine a branch for traversal” as in claim 19. Moreover, the application as originally filed does not appear to contain basis for claim 27. For example, no threshold values are discussed as being scores selected for splitting the decision tree that are stored and associated with nodes of the decision tree in the specification, and, since the claim starts by splitting the tree using thresholds, and then using the tree that is split using thresholds, none of the claim is found within the application as originally filed.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 4, 5, 10, 13, 14, 17-20, 22, 23, and 27 are rejected under 35 U.S.C. 103 as being unpatentable over Siva Kumar (U.S. Patent Application Publication 2016/0088000) in view of Brabec (U.S. Patent Application Publication 2019/0020670) and Guia (Marcio Guia et al., “Comparison of Naïve Bayes, Support Vector Machine, Decision Trees and Random Forest on Sentiment Analysis”, pp. 525-531, 2019). It is noted that Guia cites Quinlan (Quinlan J.R., “Learning Decision Tree Classifiers”, 1996, ACM Computing Surveys Vol. 28, No. 1, March 1996), which is used as an evidentiary document below to show well-known aspects of decision trees.
Regarding Claim 1,
Siva Kumar discloses one or more non-transitory computer-readable media storing instructions executable by one or more hardware processors, comprising:
Instructions for identifying a first set of textual tokens in a set of log records associated with an account for accessing a network service (Exemplary Citations: for example, Abstract, Paragraphs 34, 37-42, 57-61, 76-81, 95-100, 111-113, 126-129, 148-150, and associated figures; data from logs, such as logon session data, events, timestamps, IDs, names, and myriad other pieces of data, for example);
Instructions for training, based on the first set of textual tokens, a machine learning model to identify network attacks (Exemplary Citations: for example, Abstract, Paragraphs 34, 37-42, 57-61, 76-81, 95-100, 111-113, 126-129, 148-150, and associated figures; training models based on the log data, for example);
Instructions for detecting a new log record associated with the account for accessing the network service (Exemplary Citations: for example, Abstract, Paragraphs 28-33, 43-50, 54, 55, 62-74, 82-93, 101-109, 114-124, 130-139, 151-160, and associated figures; new log record with data, such as logon session data, associated therewith, for example);
Instructions for computing a respective score for each individual textual token in a second set of textual tokens in the new log record responsive to detecting the new log record (Exemplary Citations: for example, Abstract, Paragraphs 28-33, 43-50, 54, 55, 62-74, 82-93, 101-109, 114-124, 130-144, 151-160, and associated figures; scores corresponding to a particular model feature, different scores for each individual feature, such as -LOG(P(R|A)), -LOG(P(A|R)), -LOG(P(LT|R)), -LOG(P(LT|A)), LLR, LLA, or even a different model for LLA, as in figure 1B, or any other textual token (e.g., count for a feature, probability of a feature, etc., where each could be compared against historical values in the models, etc.), etc., as examples. Exemplary Citations: for example, Abstract, Paragraphs 34, 37-42, 57-61, 76-81, 95-100, 111-113, 126-129, 148-150, and associated figures; any numerical values determined from the above, such as counts, IP addresses, IDs, binary values, times, durations, timestamps, etc., as examples);
Instructions for computing an aggregate score for the new log record as a function of the respective score for each individual textual token in the second set of textual tokens (Exemplary Citations: for example, Abstract, 8, 48-53, 67, 88, 106, 119, 135-139, 157-170, and associated figures; combined scores, for example); and
Instructions for generating, by the machine learning model based on the second set of textual tokens in the new log record and the aggregate score for the new log record, an output that indicates whether the new log record is associated with a network attack (Exemplary Citations: for example, Abstract, Paragraphs 28-33, 43-50, 54, 55, 62-74, 82-93, 101-109, 114-124, 130-144, 151-160, and associated figures; generating an output, such as a score, normalized score, z-score, UI, combined score, label, or any other information that is output based on the above, for example);
But does not explicitly disclose that training the machine learning model includes training a decision tree based on the first set of textual tokens, wherein training the decision tree includes splitting the decision tree into multiple branches by selecting scores computed as a function of a frequency of the first set of textual tokens in individual log records in a training dataset and an inverse frequency of the first set of textual tokens across the set of log records that minimize an error function when assigning log records to different branches of the decision tree and associating leaf nodes in the decision tree with labels indicative of a probability of a network attack, that the score is a TF-IDF score, wherein generating the output includes traversing the decision tree to a leaf node based on comparing the aggregate score to the scores selected for splitting the decision tree and computed as a function of the frequency of the first set of textual tokens in individual log records in a training dataset and the inverse frequency of the first set of textual tokens across the set of log records, wherein the output is generated based on a label associated with the leaf node.
Brabec, however, discloses that training the machine learning model includes training a decision tree based on the first set of textual tokens, wherein training the decision tree includes splitting the decision tree into multiple branches by selecting data, that minimize an error function when assigning log records to different branches of the decision tree, and associating leaf nodes in the decision tree with labels indicative of a probability of a network attack (Exemplary Citations: for example, Abstract, Paragraphs 31-33, 41-47, 51, 52, 72-78, and associated figures; training forest with trees that provide labels with training data, minimizing false positives/negatives, making recall and/or precision better, etc., for example);
Wherein generating the output includes traversing the decision tree to a leaf node based on the comparing the aggregate score to the data selected for splitting the decision tree, wherein the output is generated based on a label associated with the leaf node (Exemplary Citations: for example, Abstract, Paragraphs 31-33, 41-47, 51, 52, 72-78, and associated figures; forest with trees that provide labels, for example). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the machine learning techniques of Brabec into the lateral movement detection system of Siva Kumar in order to increase the ability to detect rare malware, to allow the system to appropriately weight each tree’s decision in a forest in order to detect whether or not an attack is present, and/or to increase security in the system.
Guia, however, discloses that training the machine learning model includes training a decision tree based on the first set of textual tokens, wherein training the decision tree includes splitting the decision tree into multiple branches by selecting scores computed as a function of a frequency of the first set of textual tokens in individual log records in a training dataset and an inverse frequency of the first set of textual tokens across the set of log records, that minimize an error function when assigning log records to different branches of the decision tree and associating leaf nodes in the decision tree with labels (Exemplary Citations: for example, Abstract, Sections 1, 3.2, 3.3, 4.3, and 4.5; training trees/forests with training data, where each tree provides a label output, where the tree minimizes errors similar to above with respect to Brabec, for example. Moreover, Quinlan (Learning Decision Tree Classifiers) is cited by Guia for Guia’s decision trees and includes (e.g., pages 71-72) splitting/partitioning a tree based on thresholds, classifications at the leaf nodes, etc.);
That the score is a TF-IDF score (Exemplary Citations: for example, Abstract, Sections 1, 3.2, 3.3, 4.3, and 4.5; TF-IDF processing, for example);
Wherein generating the output includes traversing the decision tree to a leaf node based on comparing the aggregate score to the scores for splitting the decision tree and computed as a function of the frequency of the first set of textual tokens in individual log records in a training dataset and the inverse frequency of the first set of textual tokens across the set of log records, wherein the output is generated based on a label associated with the leaf node (Exemplary Citations: for example, Abstract, Sections 1, 3.2, 3.3, 4.3, and 4.5; each tree provides a label output, for example. Moreover, Quinlan (Learning Decision Tree Classifiers) is cited by Guia for Guia’s decision trees and includes (e.g., pages 71-72) splitting/partitioning a tree based on thresholds, classifications at the leaf nodes, etc.). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the processing and classification techniques of Guia into the lateral movement detection system of Siva Kumar as modified by Brabec in order to improve results via pre-processing and text transformation, to provide additional mechanisms by which to classify data, to select the best performing mechanism, and/or to increase security in the system.
Regarding Claim 19,
Claim 19 is a system claim that corresponds to media claim 1 and is rejected for the same reasons.
With respect to wherein the selected scores define threshold values associated with nodes of the decision tree for partitioning the training dataset and traversing the decision tree includes, at one or more nodes of the decision tree, comparing the aggregate score to a corresponding threshold value defined by the selected scores to determine a branch for traversal, this is found in the same sections as splitting the decision tree into multiple branches, as it simply defines splitting at certain points, as already claimed. Please also see Quinlan (Learning Decision Tree Classifiers), cited in the cited sections of Guia, which describes trees as partitioning the values being used for classification into nodes and sub-trees. This is very well-known subject matter related to decision trees.
Regarding Claim 20,
Claim 20 is a method claim that corresponds to media claim 1 and is rejected for the same reasons.
Regarding Claim 4,
Siva Kumar as modified by Brabec and Guia discloses the medium of claim 1, in addition, Siva Kumar discloses that training the machine learning model to identify network attacks comprises generating a score for each respective log record in the set of log records based at least in part on what textual tokens are included in the respective log record (Exemplary Citations: for example, Abstract, Paragraphs 8, 34, 37-42, 48-53, 57-61, 67, 76-81, 88, 95-100, 106, 111-113, 119, 126-129, 135-139, 148-150, 157-170, and associated figures; feedback based training with the system constantly training itself based on log records and feedback, generating of scores, z-scores, etc., as examples).
Regarding Claim 22,
Claim 22 is a method claim that corresponds to medium claim 4 and is rejected for the same reasons.
Regarding Claim 5,
Siva Kumar as modified by Brabec and Guia discloses the medium of claim 4, in addition, Siva Kumar discloses that generating the score for each respective log record comprises aggregating a set of individual scores assigned to the first set of textual tokens included in the respective log record (Exemplary Citations: for example, Abstract, 8, 48-53, 67, 88, 106, 119, 135-139, 157-170, and associated figures; combined scores, for example).
Regarding Claim 23,
Claim 23 is a method claim that corresponds to medium claim 5 and is rejected for the same reasons.
Regarding Claim 10,
Siva Kumar as modified by Brabec and Guia discloses the medium of claim 1, in addition, Siva Kumar discloses that the new log record is generated based on a login attempt to the account (Exemplary Citations: for example, Abstract, Paragraphs 28-33, 43-50, 54, 55, 62-74, 82-93, 101-109, 114-124, 130-139, 151-160, and associated figures).
Regarding Claim 13,
Siva Kumar as modified by Brabec and Guia discloses the medium of claim 1, in addition, Siva Kumar discloses performing one or more actions to counter a detected network attack based on the output (Exemplary Citations: for example, Abstract, Paragraphs 28-33, 43-50, 54, 55, 62-74, 82-93, 101-109, 114-124, 130-144, 151-160, and associated figures; providing list of alerts, compromised accounts, compromised machines, etc., to an analyst, for example).
Regarding Claim 14,
Siva Kumar as modified by Brabec and Guia discloses the medium of claim 13, in addition, Siva Kumar discloses that the one or more actions are executed responsive to determining that a severity of the detected network attack satisfies a threshold (Exemplary Citations: for example, Abstract, Paragraphs 28-33, 43-50, 54, 55, 62-74, 82-93, 101-109, 114-124, 130-144, 151-160, and associated figures; top k are most severe, for example).
Regarding Claim 17,
Siva Kumar as modified by Brabec and Guia discloses the medium of claim 1, in addition, Siva Kumar discloses that the trained machine learning model includes at least three classification labels based on at least one of predicted likelihood that the new log record is associated with the network attack or a predicted severity of the network attack (Exemplary Citations: for example, Abstract, Paragraphs 28-33, 43-51, 54, 55, 62-74, 82-93, 101-109, 114-124, 130-144, 151-160, 164, and associated figures); and
Brabec discloses that the trained machine learning model includes at least three classification labels based on at least one of predicted likelihood that the new log record is associated with the network attack or a predicted severity of the network attack (Exemplary Citations: for example, Abstract, Paragraphs 31-33, 41-47, 51, 52, 72-78, and associated figures; malicious, anomalous, benign, numerous malicious class labels, etc., as examples)
Regarding Claim 18,
Siva Kumar as modified by Brabec and Guia discloses the medium of claim 17, in addition, Siva Kumar discloses that the at least three classification labels include a first label for events that have an estimated value above a first threshold, a second label for events that have an estimated value above a second threshold and below the first threshold, and a third label for events that have an estimate value below a third threshold (Exemplary Citations: for example, Abstract, Paragraphs 28-33, 43-51, 54, 55, 62-74, 82-93, 101-109, 114-124, 130-144, 151-160, 164, and associated figures; top-k, less than top k (but above 0) and less than top k, for example); and
Brabec discloses that the at least three classification labels include a first label for events that have an estimated value above a first threshold, a second label for events that have an estimated value above a second threshold and below the first threshold, and a third label for events that have an estimate value below a third threshold (Exemplary Citations: for example, Abstract, Paragraphs 31-33, 41-47, 51, 52, 72-78, and associated figures; probabilities for predicted labels, voting, thresholding, weighting, etc., as examples).
Regarding Claim 27,
Siva Kumar as modified by Brabec and Guia discloses the medium of claim 1, in addition, Siva Kumar as modified by Brabec and Guia discloses that the scores selected for splitting the decision tree are stored as threshold values associated with nodes of the decision tree (Brabec: Exemplary Citations: for example, Abstract, Paragraphs 31-33, 41-47, 51, 52, 72-78, and associated figures; Guia: Exemplary Citations: for example, Abstract, Sections 1, 3.2, 3.3, 4.3, and 4.5, including Guia’s citation to Quinlan (pages 71-72), this is how decision trees are setup to work, for example),
Traversing the decision tree includes comparing an aggregate score for a new log record to the threshold values at each node to determine a branch for traversal (Brabec: Exemplary Citations: for example, Abstract, Paragraphs 31-33, 41-47, 51, 52, 72-78, and associated figures; Exemplary Citations: for example, Abstract, Sections 1, 3.2, 3.3, 4.3, and 4.5, including Guia’s citation to Quinlan (pages 71-72), this is how decision trees are setup to work, for example),
Computing the aggregate score for the new log record includes aggregating respective TF-IDF scores for a plurality of textual tokens within the new log record by summing, averaging, or otherwise combining the respective TF-IDF scores to generate a single scalar score for the new log record (Siva Kumar: Exemplary Citations: for example, Abstract, 8, 48-53, 67, 88, 106, 119, 135-139, 157-170, and associated figures; Brabec: Exemplary Citations: for example, Abstract, Paragraphs 31-33, 41-47, 51, 52, 72-78, and associated figures; Guia: Exemplary Citations: for example, Abstract, Sections 1, 3.2, 3.3, 4.3, and 4.5; aggregate scores and TF-IDFs, for example),
Each TF-IDF score is computed based on (i) a frequency of a corresponding textual token within the new log record and (ii) an inverse frequency of the corresponding textual token across a plurality of historical log records associated with the account within a defined timeframe (Guia: Exemplary Citations: for example, Abstract, Sections 1, 3.2, 3.3, 4.3, and 4.5; term frequency/inverse document frequency, for example),
The decision tree is trained by selecting, for at least one node, a TF-IDF-derived score that minimizes an error function and using the selected TF-IDF-derived score as a threshold to partition training examples into branches (Brabec: Exemplary Citations: for example, Abstract, Paragraphs 31-33, 41-47, 51, 52, 72-78, and associated figures; Guia: Exemplary Citations: for example, Abstract, Sections 1, 3.2, 3.3, 4.3, and 4.5, including Guia’s citation to Quinlan (pages 71-72); decision tree using TF-IDF, for example),
The decision tree is further trained by recursively splitting nodes based on TF-IDF-derived scores until a stopping criterion is satisfied, and pruning one or more nodes based on a determination that the nodes are less predictive of network attacks (Siva Kumar: Exemplary Citations: for example, Abstract, 8, 48-53, 67, 88, 106, 119, 135-139, 157-170, and associated figures; Brabec: Exemplary Citations: for example, Abstract, Paragraphs 31-33, 41-47, 51, 52, 72-78, and associated figures; Guia: Exemplary Citations: for example, Abstract, Sections 1, 3.2, 3.3, 4.3, and 4.5, including Guia’s citation to Quinlan (pages 71-72); decision tree splits nodes at each level, as well as pruning subtrees that contribute little to predictive accuracy, on trees used for detecting network attacks, for example), and
Generating the output further includes applying a plurality of decision trees and aggregating predictions from the plurality of decision trees to generate a final classification of whether the new log record is associated with a network attack (Siva Kumar: Exemplary Citations: for example, Abstract, Paragraphs 28-33, 43-50, 54, 55, 62-74, 82-93, 101-109, 114-124, 130-144, 151-160, and associated figures; Brabec: Exemplary Citations: for example, Abstract, Paragraphs 31-33, 41-47, 51, 52, 72-78, and associated figures; Exemplary Citations: for example, Abstract, Sections 1, 3.2, 3.3, 4.3, and 4.5, including Guia’s citation to Quinlan (pages 71-72); multiple trees, forest, voting between them to determine final classification, for example).
Claims 7, 8, 24, and 25 are rejected under 35 U.S.C. 103 as being unpatentable over Siva Kumar in view of Brabec, Guia, and Gardner (U.S. Patent 11,093,833).
Regarding Claim 7,
Siva Kumar as modified by Brabec and Guia discloses the medium of claim 1, in addition, Siva Kumar discloses pruning an entity based at least in part on the scores (Exemplary Citations: for example, Abstract, Paragraphs 34, 37-42, 57-61, 76-81, 95-100, 111-113, 126-129, 148-150, and associated figures; updating models, removing models, splitting data into time slots in one model, then pruning them out of these timeslots for another model, etc., as examples);
But does not explicitly disclose pruning a decision tree.
Gardner, however, discloses pruning the decision tree based at least in part on the scores (Exemplary Citations: for example, Column 4, lines 5-26; Column 18, lines 33-46; Column 28, line 60 to Column 29, line 30; and associated figures; pruning trees, for example). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the machine learning model training techniques of Gardner into the lateral movement detection system of Siva Kumar as modified by Brabec and Guia in order to allow the system to better train the machine learning models, to allow for fine tuning of parameters and decision trees to give a better result, to allow for use of well-known machine learning techniques to be used, and/or to increase security in the system.
Regarding Claim 24,
Claim 24 is a method claim that adds the same subject matter as medium claim 7 and is rejected for the same reasons.
Regarding Claim 8,
Siva Kumar as modified by Brabec and Guia does not explicitly disclose adjusting at least one model hyperparameter to balance between a precision and a recall of the machine learning model.
Gardner, however, discloses adjusting at least one model hyperparameter to balance between a precision and a recall of the machine learning model (Exemplary Citations: for example, Title, Abstract; Column 3, line 41 to Column 4, line 4; Column 15, lines 45-67; Column 18, lines 33-60; and associated figures; the entirety of Gardner is directed to hyperparameter tuning, as seen in the title, and this is done to create balance between a variety of parameters, including F1 scores, recall, precision, etc., for example). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the machine learning model training techniques of Gardner into the lateral movement detection system of Siva Kumar as modified by Brabec and Guia in order to allow the system to better train the machine learning models, to allow for fine tuning of parameters and decision trees to give a better result, to allow for use of well-known machine learning techniques to be used, and/or to increase security in the system.
Regarding Claim 25,
Claim 25 is a method claim that corresponds to medium claim 8 and is rejected for the same reasons.
Claims 9 and 26 are rejected under 35 U.S.C. 103 as being unpatentable over Siva Kumar in view of Brabec, Guia, and Grajek (U.S. Patent Application Publication 2018/0069867).
Regarding Claim 9,
Siva Kumar as modified by Brabec and Guia discloses the medium of claim 1, in addition, Siva Kumar discloses that the set of textual tokens include values identifying a network address and other information associated with login attempts to the account for accessing the network service (Exemplary Citations: for example, Paragraphs 29-31, 44, 64, 84, 103, 116, 129, 152, and associated figures);
But does not appear to explicitly disclose that the values include language, browser, and location.
Grajek, however, discloses that the set of textual tokens include values identifying a network address, language, browser, and location associated with login attempts to the account for accessing the network service (Exemplary Citations: for example, Paragraph 24 and associated figures; all of this information is included therein regarding a user’s logon session, for example). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the authentication techniques of Grajek into the lateral movement detection system of Siva Kumar as modified by Brabec and Guia in order to take into account additional information regarding sessions, thereby resulting in a more accurate assessment, to allow for additional verifications, such as geo-velocity checks, and/or to increase security in the system.
Regarding Claim 26,
Claim 26 is a method claim that corresponds to medium claim 9 and is rejected for the same reasons.
Claims 13-15 are rejected under 35 U.S.C. 103 as being unpatentable over Siva Kumar in view of Brabec, Guia, and Kirti (U.S. Patent Application Publication 2018/0375886).
Regarding Claim 15,
Siva Kumar as modified by Brabec and Guia does not explicitly disclose that the one or more actions include at least one of locking a user account, sending a user a one time password, or enabling two factor authentication.
Kirti, however, discloses that the one or more actions include at least one of locking a user account, sending a user a one time password, or enabling two factor authentication (Exemplary Citations: for example, Paragraphs 51-53, 79-81, 114-117, 174-180, and associated figures; action, such as alert, remediation action, recommendation, locking account, etc., as examples). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the remediation techniques of Kirti into the lateral movement detection of Siva Kumar as modified by Brabec and Guia in order to allow the system to take appropriate action upon detecting a malicious event/session, to allow for locking a user out of their account if they are abusing the system, to provide for numerous recommendations as well as automatic actions as necessary when a threat is detected, and/or to increase security in the system.
Regarding Claim 13,
Siva Kumar as modified by Brabec and Guia discloses the medium of claim 1, in addition, Siva Kumar discloses performing one or more actions to counter a detected network attack based on the output (Exemplary Citations: for example, Abstract, Paragraphs 28-33, 43-50, 54, 55, 62-74, 82-93, 101-109, 114-124, 130-144, 151-160, and associated figures; providing list of alerts, compromised accounts, compromised machines, etc., to an analyst, for example).
Kirti also discloses performing one or more actions to counter a detected network attack based on the output (Exemplary Citations: for example, Paragraphs 51-53, 79-81, 114-117, 174-180, and associated figures). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the remediation techniques of Kirti into the lateral movement detection of Siva Kumar as modified by Brabec and Guia in order to allow the system to take appropriate action upon detecting a malicious event/session, to allow for locking a user out of their account if they are abusing the system, to provide for numerous recommendations as well as automatic actions as necessary when a threat is detected, and/or to increase security in the system.
Regarding Claim 14,
Siva Kumar as modified by Brabec, Guia, and Kirti discloses the media of claim 13, in addition, Siva Kumar discloses that the one or more actions are executed responsive to determining that a severity of the detected network attack satisfies a threshold (Exemplary Citations: for example, Abstract, Paragraphs 28-33, 43-50, 54, 55, 62-74, 82-93, 101-109, 114-124, 130-144, 151-160, and associated figures; top k are most severe, for example); and
Kirti discloses that the one or more actions are executed responsive to determining that a severity of the detected network attack satisfies a threshold (Exemplary Citations: for example, Paragraphs 8, 51-53, 79-81, 114-117, 141-146, 150-158, 174-180, 211, 212, and associated figures; actions as above based on thresholds, for example).
Regarding Claim 15,
Siva Kumar as modified by Brabec, Guia, and Kirti discloses the media of claim 13, in addition, Kirti discloses that the one or more actions include at least one of locking a user account, sending a user a one time password, or enabling two factor authentication (Exemplary Citations: for example, Paragraphs 8, 51-53, 79-81, 114-117, 141-146, 150-158, 174-180, 211, 212, and associated figures).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Jeffrey D Popham whose telephone number is (571)272-7215. The examiner can normally be reached Monday through Friday 9:00-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson can be reached at (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Jeffrey D. Popham/Primary Examiner, Art Unit 2432
