DETAILED ACTION
Response to Amendment
The amendment filed on 30 October 2025 has been entered.
Claims 1-20 are pending.
Claims 1-20 are amended.
Response to Arguments
Applicant's arguments filed on 30 October 2025 have been fully considered, but they are not persuasive.
Applicant’s remarks, regarding the rejections of claims under 35 USC 101, have been fully considered.
Applicant notes the pending claims, as amended are not directed to an abstract idea, but instead are directed to a specific technological improvement in computer implemented network security systems. Applicant submits claim limitations provide an integration of machine learning models within a network security appliance to perform dynamic packet level classification using a dual model skepticism framework and this framework improves system operations by enabling the network security appliance to identify unreliable classifications, select representative traffic vectors, and retain a model in real time, which improves accuracy and responsiveness of the network security appliance without manual intervention.
Examiner notes Applicant’s arguments, as outlined above, are directed to newly amended claim limitations for which Examiner has not yet made a prima facie case for, rendering Applicant’s arguments moot.
Applicant’s remarks, regarding the rejections of claims under 35 USC 103, have been fully considered.
Applicant submits none of the cited references teach or suggest use of dual, independently trained machine learning models that classify network vectors, and the outputs of which are compared to generate skepticism values that are used to determine when to retrain the first model as recited in the claims.
Applicant’s arguments have been considered, but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 30 October 2025 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered and attached by the examiner.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1 and analogous claims 10 and 12 recites the limitation "the first dataset" in lines 37-38. There is insufficient antecedent basis for this limitation in the claim. For examination purposes, the term "the first dataset" has been construed to be “a first dataset”. Claims 2-9, 11, 13-20, which depend from claims 1, 10, 12, are similarly rejected.
Claim 1 and analogous claims 10 and 12 recites the limitation "the labeled first decision output" in lines 38. There is insufficient antecedent basis for this limitation in the claim. For examination purposes, the term "the labeled first decision output" has been construed to be “a labeled first decision output”. Claims 2-9, 11, 13-20, which depend from claims 1, 10, 12, are similarly rejected.
The term “most” in line 30 of claim 1 and analogous claims 10, 12, is a relative term which renders the claim indefinite. The term “most” is not defined by the claim, the specification does not provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would not be reasonably apprised of the scope of the invention. For examination purposes, the term "most recently received” has been construed to be any vectors that have been previously received. Claims 2-9, 11, 13-20, which depend from claims 1, 10, 12, are similarly rejected.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception, abstract idea, without significantly more.
Step 1: This part of the eligibility analysis evaluates whether the claim(s) falls within any statutory
category. MPEP 2106.03:
According to the first part of the Alice analysis, in the instant case, the claims were determined
to be directed to one of the four statutory categories: an article of manufacture, a method/process (Claims 1-9), a machine/system/product (Claims 10-20), and a composition of matter. Based on the claims being determined to be within of the four categories (i.e., process, machine, manufacture, or composition of matter), (Step 1), it must be determined if the claims are directed to a judicial exception (i.e., law of nature, natural phenomenon, and abstract idea).
Step 2A Prong One: This part of the eligibility analysis evaluates whether the claim(s) recites a
judicial exception.
Regarding independent claims 1, 10, 12, the claims recite a judicial exception (i.e., an abstract idea enumerated in the 2019 PEG) without significantly more (Step-2A: Prong One). The applicant's claim limitations under broadest reasonable interpretation covers activities classified under mental processes - concepts performed in the human mind (including an observation, evaluation, judgment, opinion) (see MPEP § 2106.04(a)(2), subsection Ill) and the 2019 PEG. As evaluated below:
Claims 1, 10, 12:
“determining, for each of the network traffic vectors, a skepticism value based on a divergence between an output of the first model and an output of the second model for the corresponding vector” (mental process of evaluation)
“selecting, from the sliding window, one or more skepticism value vectors having skepticism values that exceed a threshold value” (mental process of judgement)
If the identified limitation(s) falls within at least one of the groupings of abstract ideas, it is
reasonable to conclude that the claim(s) recites an abstract idea in Step 2A Prong One.
Step 2A Prong Two: This part of the eligibility analysis evaluates whether the claim(s) as a whole integrates the recited judicial exception into a practical application of the exception. As evaluated below:
“receiving, by a network security appliance, a plurality of network traffic vectors derived from packet data communicated over a network”
“storing the plurality of network traffic vectors within a sliding window of most recently received vectors”
These recitations are deemed insufficient to transform the judicial exception to a patentable invention because the recitation is directed to instructions for mere data gathering or data output, see MPEP 2106.05(g).
“training, by a processor, a first machine learning model to classify the network traffic vectors into multiple traffic categories”
“training, independently of the first machine learning model, a second machine learning model to generate second classification outputs for the same network traffic vectors”
“improving classification accuracy for subsequently received network traffic vectors by retraining, by the processor, only the first machine learning model using the selected skepticism value vectors based on at least a subset of the first dataset and the labeled first decision output”
These recitations are deemed insufficient to transform the judicial exception to a patentable invention because the recitation is directed to instructions merely indicating a field of use or technological environment in which to apply a judicial exception, see MPEP 2106.05(h).
Accordingly, these additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea when considered as an ordered combination and as a whole.
Step 2B: This part of the eligibility analysis evaluates whether the claim, as a whole, amounts to
significantly more than the recited exception, i.e., whether any additional element, or combination of
additional elements, adds an inventive concept to the claim. MPEP 2106.05.
First, the additional elements considered as part of the preamble and the additional elements
directed to the use of computer technology are deemed insufficient to transform the judicial exception
to a patentable invention to a patentable invention because they generally link the judicial exception to
the technology environment, see MPEP 2106.05(h).
Second, the claims are directed to instructions merely indicating a field of use or technological environment in which to apply a judicial exception. The courts have found these types of limitations insufficient to transform the judicial exception to a patentable invention, see MPEP 2106.05(g).
Lastly, the claims directed to data gathering activity as noted above, are deemed directed to an insignificant extra-solution activity. The courts have found these types of limitations insufficient to
qualify as "significantly more", see MPEP 2106.05(g).
Furthermore, when considering evidence in view of Berkheimer v. HP, Inc., 881 F.3d 1360, 1368, 125 USPQ2d 1649, 1654 (Fed. Cir. 2018), see USPTO Berkheimer Memorandum (April 2018). Examiner notes Berkheimer: Option 2 - A citation to one or more of the court decisions discussed in MPEP § 2106.05(d}(II} as noting the well understood, routine, conventional nature of the additional element (s) (e.g., limitations directed to mere data gathering):
The courts have recognized the following computer functions as well understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity, see MPEP 2106.05(d).
The additional limitations, as analyzed, failed to integrate a judicial exception into a practical application at Step 2A and provide an inventive concept in Step 2B, per the analysis above. Thus, considering the additional elements individually and in combination and the claims as a whole, the additional elements do not provide significantly more than the abstract idea. This claim is not patent eligible. Therefore, in examining elements as recited by the limitations individually and as an ordered combination, as a whole, claims 1, 10, 12 do not recite what the courts have identified as "significantly more".
Furthermore, regarding dependent claims 2-9, which depend from claim 1, claim 11, which depend from claim 10, and claims 13-20, which depend from claim 12, the claims are directed to a judicial exception (i.e., an abstract idea enumerated in the 2019 PEG, a law of nature, or a natural phenomenon) without significantly more as highlighted below in the claim limitations by evaluating the claim limitations under the Step2A and 2B:
Claims 2, 11, 13:
Incorporates the rejections of claims 1, 10, 12, respectively.
“selecting the skepticism value vectors comprises comparing the difference to a predetermined threshold” (mental process of judgement)
The recitation is directed to mere instructions to implement an abstract idea on a computer, or
merely uses a computer as a tool to perform an abstract idea and are considered adding the words "apply it" (or an equivalent) with the judicial exception, See MPEP 2106.05(f).
“wherein the skepticism value comprises a difference between confidence scores generated by the first and second machine learning models for a corresponding vector”
These recitations are deemed insufficient to transform the judicial exception to a patentable invention because the recitation is directed to instructions merely indicating a field of use or technological environment in which to apply a judicial exception, see MPEP 2106.05(h).
Limitations directed to mere instructions to implement an abstract idea on a computer/using computer as a tool or directed to instructions merely indicating a field of use or technological environment in which to apply a judicial exception cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B.
Claims 3, 14, 15:
Incorporates the rejections of claims 1, 12, 14, respectively.
“wherein the sliding window is continuously updated by adding a newly received network traffic vector and removing an oldest network traffic vector to maintain a fixed window size”
These recitations are deemed insufficient to transform the judicial exception to a patentable invention because the recitation is directed to instructions merely indicating a field of use or technological environment in which to apply a judicial exception, see MPEP 2106.05(h).
Limitations directed to mere instructions indicating a field of use or technological environment in which to apply a judicial exception cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B.
Claim 4:
Incorporates the rejection of claim 1.
“wherein the network security appliance applies the retrained first machine learning model to classify real time packet streams into malicious and non-malicious categories to control network access”
These recitations are deemed insufficient to transform the judicial exception to a patentable invention because the recitation is directed to instructions merely indicating a field of use or technological environment in which to apply a judicial exception, see MPEP 2106.05(h).
Limitations directed to mere instructions indicating a field of use or technological environment in which to apply a judicial exception cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B.
Claims 5, 16:
Incorporates the rejections of claims 1, 12, respectively.
“wherein the first machine learning model and the second machine learning model each comprise respective neural networks trained using different subsets of network traffic vectors”
These recitations are deemed insufficient to transform the judicial exception to a patentable invention because the recitation is directed to instructions merely indicating a field of use or technological environment in which to apply a judicial exception, see MPEP 2106.05(h).
Limitations directed to mere instructions indicating a field of use or technological environment in which to apply a judicial exception cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B.
Claims 6, 17:
Incorporates the rejections of claims 1, 12, respectively.
“wherein the first machine learning model is a discriminative classifier and the second machine learning model is a generative classifier that produces probabilistic confidence outputs used in computing the skepticism value”
These recitations are deemed insufficient to transform the judicial exception to a patentable invention because the recitation is directed to instructions merely indicating a field of use or technological environment in which to apply a judicial exception, see MPEP 2106.05(h).
Limitations directed to mere instructions indicating a field of use or technological environment in which to apply a judicial exception cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B.
Claims 7, 18:
Incorporates the rejections of claims 1, 12, respectively.
“wherein determining the skepticism value comprises computing a confidence divergence metric between probability distributions generated by the first and second machine learning models for each network traffic vector” (mental process of judgement)
The recitation is directed to mere instructions to implement an abstract idea on a computer, or
merely uses a computer as a tool to perform an abstract idea and are considered adding the words "apply it" (or an equivalent) with the judicial exception, See MPEP 2106.05(f).
Limitations directed to mere instructions to implement an abstract idea on a computer/using computer as a tool cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B.
Claims 8, 19:
Incorporates the rejections of claims 7, 18, respectively.
“wherein: retraining only the first machine learning model using the selected skepticism vectors comprises adjusting weights of the first machine learning model to reduce classification disagreement with the second model for subsequent network traffic vectors”
These recitations are deemed insufficient to transform the judicial exception to a patentable invention because the recitation is directed to instructions merely indicating a field of use or technological environment in which to apply a judicial exception, see MPEP 2106.05(h).
Limitations directed to mere instructions indicating a field of use or technological environment in which to apply a judicial exception cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B.
Claims 9, 20:
Incorporates the rejections of claims 7, 18, respectively.
“the method further comprising: deploying the retrained first machine learning model within the network security appliance to perform real time packet inspection, wherein packets classified as malicious are blocked or quarantined”
These recitations are deemed insufficient to transform the judicial exception to a patentable invention because the recitation is directed to instructions merely indicating a field of use or technological environment in which to apply a judicial exception, see MPEP 2106.05(h).
Limitations directed to mere instructions indicating a field of use or technological environment in which to apply a judicial exception cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B.
The dependent claims as analyzed above, do not recite limitations that integrated the judicial exception into a practical application. In addition, the claim limitations do not include additional elements that are sufficient to amount to significantly more than the judicial exception (Step-2B). Therefore, the claims do not recite any limitations, when considered individually or as a whole, that recite what have the courts have identified as "significantly more", see MPEP 2106.05; and therefore, as a whole the claims are not patent eligible. As shown above, the dependent claims do not provide any additional elements that when considered individually or as an ordered combination, amount to significantly more than the abstract idea identified. Therefore, as a whole, the dependent claims do not recite what have the courts have identified as "significantly more" than the recited judicial exception. Therefore, claims 2-9, 11, and 13-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception and does not recite, when claim elements are examined individually and as a whole, elements that the courts have identified as "significantly more" than the recited judicial exception.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1, 3, 5-8, 10, 12, 14-19 are rejected under 35 U.S.C. 103 as being unpatentable over Di Pietro et al. (U.S. Pre-Grant Publication No. 20160028762, hereinafter ‘Di Pietro'), in view of Baker et al. (U.S. Pre-Grant Publication No. 20200285939, hereinafter ‘Baker'), Brown et al. (U.S. Pre-Grant Publication No. 20220101112, hereinafter ‘Brown'), and further in view of Wu et al. (NPL: "Sliding Window Optimized Information Entropy Analysis Method for Intrusion Detection on In-Vehicle Networks", hereinafter 'Wu').
Regarding claim 1 and analogous claims 10 and 12, Di Pietro teaches A computer-implemented method for classifying network data, the method comprising:
receiving, by a network security appliance, a plurality of network traffic vectors derived from packet data communicated over a network [0053] Referring now to FIG. 4, the receiving, by a network security appliance system 400 takes as input a steady flow of detailed derived from packet data communicated over a network traffic records (e.g., data flows), where the system 400 may be hosted on a device such as the device 200, as shown in FIG. 2, for example. Once they are received, such records are stored in a cache whose purpose is to provide a detailed snapshot of the current traffic composition. The cache may be denoted as the Detailed Records Cache (DRC) 420 (e.g., stored within data structures 245 of device 200).; [0054] Subsequently, each record stored in the DRC 420 may be fed into the aggregator 430 that computes a plurality of network traffic vectors a vector of aggregated features for the current traffic composition.);
training, by a processor, a first machine learning model to classify the network traffic vectors into multiple traffic categories ([0042] As shown in FIG. 3A, assume that the particular node/device 104 under attack is configured to execute an attack detector process (e.g., process 248). In general, the attack detector process may be operable to observe traffic behavior and apply a label (e.g., a classification) to the observed traffic behavior.; [0057] Such aggregated features are then forwarded to a training, by a processor, a first machine learning model ML-based attack detector 440, which is configured to make a decision about whether an attack is taking place by examining the received aggregated feature vectors from the aggregator 430. Various suitable attack detection techniques may be utilized by the attack detector 440. Optionally, the detector 440 can also include a to classify the network traffic vectors into multiple traffic categories classification result that specifies the type of the detected attack.);
Di Pietro fails to teach training, independently of the first machine learning model, a second machine learning model to generate second classification outputs for the same network traffic vectors; determining, for each of the network traffic vectors, a skepticism value based on a divergence between an output of the first model and an output of the second model for the corresponding vector; storing the plurality of network traffic vectors within a sliding window of most recently received vectors; selecting, from the sliding window, one or more skepticism value vectors having skepticism values that exceed a threshold value; improving classification accuracy for subsequently received network traffic vectors by retraining, by the processor, only the first machine learning model using the selected skepticism value vectors based on at least a subset of the first dataset and the labeled first decision output.
Baker teaches training, independently of the first machine learning model, a second machine learning model to generate second classification outputs for the same network traffic vectors ([0080] A block diagram of one illustrative example of a way that a restricted system may be developed from an unrestricted system with the help of a generator 123 is shown in FIG. 1B. The process illustrated in FIG. 1B could be performed by a computer system, such as the computer system 4100 shown in FIG. 41. FIG. 1B illustrates transfer of knowledge from a first classifier 124 to a training, independently of the first machine learning model, a second machine learning model second classifier 125. This knowledge transfer could be called “transfer learning.” However, the phrase “transfer learning” is sometimes afforded a technical definition in that art that differs from the process described here. Therefore, the process of knowledge transfer from classifier 124 to classifier 125 is herein referred to as “learning by imitation.” Other illustrative embodiments of learning by imitation are illustrated in FIGS. 27A and 27B. This block diagram can be used to transfer knowledge between any two classifiers. For example, the first classifier 124 can be an unrestricted classifier and the second classifier 125 can be a restricted classifier.; 4. The second classifier 125 is generate second classification outputs for the same network traffic vectors trained using data examples from the first classifier 124 as a target output and assessed using independent test data. In other words, the target objective for the second classifier 125 is to produce the same output as the first classifier 124.; [0162] In some embodiments, block 121 uses the MGM illustrated in FIGS. 19 and 20. As illustrated in FIG. 20, an MGM contains both generators and detectors. An MGM can both generate simulated data and classify it.);
Di Pietro and Baker are considered to be analogous to the claimed invention because they are in the same field of anomaly detection. In view of the teachings of Di Pietro, it would have been obvious for a person of ordinary skill in the art to apply the teachings of Baker to Di Pietro before the effective filing date of the claimed invention in order to separate the process of detailed learning and knowledge acquisition and the process of imposing restrictions and smoothing estimates, thereby allowing machine learning systems to aggressively learn from training data, while mitigating the effects of overfitting on the training data (cf. Baker, [0003] The present invention, in one general aspect, is designed to overcome limitations related to aggressively training machine learning systems. When training a machine learning system, there is always a trade-off between allowing a machine learning system to learn as much as it can from training data and overfitting on the training data. This trade-off is important because overfitting usually causes performance on new data to be worse. However, the various systems and methods described herein can be utilized, either alone or in various combinations, to separate the process of detailed learning and knowledge acquisition and the process of imposing restrictions and smoothing estimates, thereby allowing machine learning systems to aggressively learn from training data, while mitigating the effects of overfitting on the training data.).
Brown teaches determining, for each of the network traffic vectors, a skepticism value based on a divergence between an output of the first model and an output of the second model for the corresponding vector ([0075] In at least one embodiment, data processing service 304 performs a data processing technique such as AugMix, which is a data augmentation technique that utilizes stochasticity, diverse augmentations, a JSD consistency loss, and a formulation to mix multiple augmented inputs. AugMix improves model robustness under data shift as small corruptions are enough to subvert existing classifiers which depend on an ability of content input 302 to faithfully represent a distribution of data encountered during deployment may be achieved. In AugMix, to mitigate input degradation but retain augmentation diversity, several stochastically sampled augmentation chains are layered together in a convex combination to generate highly diverse transformations. Mixing coefficients are randomly sampled from a Dirichlet distribution with shared concentration parameters, and a resulting augmented versions of content input 306 is combined with original content input 302 through a second random convex combination sampled from a beta distribution, again with shared parameters. In addition, AugMix minimizes JSD across softmax-formed distributions
PNG
media_image1.png
38
29
media_image1.png
Greyscale
orig,
PNG
media_image1.png
38
29
media_image1.png
Greyscale
aug1, and
PNG
media_image1.png
38
29
media_image1.png
Greyscale
aug2 of between an output of the first model and an output of the second model for the corresponding vector an original sample xorig and its augmented variants xaug1 and xaug1. This determining, for each of the network traffic vectors, a skepticism value JSD term is computed with M=(
PNG
media_image1.png
38
29
media_image1.png
Greyscale
orig+
PNG
media_image1.png
38
29
media_image1.png
Greyscale
aug1+
PNG
media_image1.png
38
29
media_image1.png
Greyscale
aug2)/3 and is then:JSD=⅓(KL(
PNG
media_image1.png
38
29
media_image1.png
Greyscale
orig ∥M+KL(
PNG
media_image1.png
38
29
media_image1.png
Greyscale
aug1 ∥M+KL(
PNG
media_image1.png
38
29
media_image1.png
Greyscale
aug2 ∥M))(4); [0076] where KL (p∥q) is based on a divergence Kullback-Leibler divergence from q to p, which then drives a model to be stable and consistent across a diverse range of inputs.; [0078] In at least one embodiment, a different pre-trained model different from an average model 404 is used, such as a model that is calculated differently, a model that is trained using different training data, a different type of model trained to perform a same task (e.g., classification) or otherwise another neural network that is different from a neural network being trained.; [0103] In at least one embodiment, unsupervised training can also be used to perform anomaly detection, which allows identification of data points in new dataset 1012 that deviate from normal patterns of new dataset 1012.);
improving classification accuracy for subsequently received network traffic vectors by retraining, by the processor, only the first machine learning model using the selected skepticism value vectors based on at least a subset of the first dataset and the labeled first decision output ([0077] In at least one embodiment, as training a neural network proceeds, a number of perturbations of content input 302 is increased. In at least one embodiment, during early stages of training, variations of content input 302 make it difficult to determine a set of correct weights. In at least one embodiment, as training progresses and a neural network is refined, a number of perturbations is increased to improving classification accuracy for subsequently received network traffic vectors accelerate training and more quickly decrease an effect of mislabeled images. In at least one embodiment, content input 302 is augmented over multiple training rounds instead of training multiple images. In at least one embodiment, neural network is refined using repeated perturbations of same samples rather than single variations of over more samples. In at least one embodiment, data processing service 304 returns using the selected skepticism value vectors based on at least a subset of the first dataset and the labeled first decision output augmented content (e.g., augmented training data, augmented images) 306 as input to update a model in training.; [0559] In at least one embodiment, model training 3814 may include by retraining, by the processor, only the first machine learning model retraining or updating an initial model 4204 (e.g., a pre-trained model) using new training data (e.g., new input data, such as customer dataset 4206, and/or new ground truth data associated with input data). In at least one embodiment, to retrain, or update, initial model 4204, output or loss layer(s) of initial model 4204 may be reset, or deleted, and/or replaced with an updated or new output or loss layer(s). In at least one embodiment, initial model 4204 may have previously fine-tuned parameters (e.g., weights and/or biases) that remain from prior training, so training or retraining 3814 may not take as long or require as much processing as training a model from scratch.).
Di Pietro, Baker, and Brown are considered to be analogous to the claimed invention because they are in the same field of anomaly detection. In view of the teachings of Di Pietro and Baker, it would have been obvious for a person of ordinary skill in the art to apply the teachings of Brown to Di Pietro before the effective filing date of the claimed invention in order to involve augmenting training data to diminish effects of mislabeled data on training processes (cf. Brown, [0058] Machine learning models, such as deep neural networks, are often trained to infer information from images. Often, training images come with many different labels to aid training. Labels may come from, for example, different users who have annotated images and/or output from different NLP algorithms, which may cause inherent ambiguity, such as unavoidable noise with respect to labels themselves, when performing image analysis tasks. Often times, noisy labels (also referred to as mislabels, erroneous labels, or incorrect labels) comprise text data that are off-point compared with contents of an image. As an example, an image of a cat is mislabeled as an airplane or an image of an airplane is mislabeled as a hotdog.; [0059] To address such mislabeling, in at least one embodiment, techniques described herein involve augmenting training data to diminish effects of mislabeled data on training processes.).
Wu teaches storing the plurality of network traffic vectors within a sliding window of most recently received vectors; selecting, from the sliding window, one or more skepticism value vectors having skepticism values that exceed a threshold value ([B. FRAMEWORK OF THE PROPOSED METHOD, pg. 45236] As shown in Figure 5, the framework of our proposed method is mainly divided into two phases. One is the off-line training phase. The Simulated Annealing sliding algorithm is used to get an optimal sliding window parameter. The second phase is the on-line detection phase. According to the parameters obtained in the training phase, an intrusion detection system is set up to detect abnormal intrusions. 1) OFF-LINE TRAINING PHASE The training phase of the method mainly includes the following steps. • Step 1: add attack block (carrying tags for evaluation) to the test data set. More details on the generation of data sets used in the training phase are described in the following Section V. • Step 2: extract the CAN message IDs from the test data set to get a new IDs set. • Step 3: use the sliding window as an information entropy sampling window to analyze the information entropy of the message IDs storing the plurality of network traffic vectors within a sliding window of most recently received vectors captured within the sliding window. • Step 4: compare the information entropy obtained in Step 3 with the range of normal information entropy to determine whether there is an attack block. • Step 5: selecting, from the sliding window, one or more skepticism value vectors having skepticism values that exceed a threshold value compare the attack result obtained in Step 4 with the tag of the added attack block, and obtain the initial detection accuracy data. • Step 6: select the new sliding window size and normal range for the next iteration. The whole training process uses simulated annealing algorithm and repeats the above Step 1 to Step 6 to obtain the best sliding window size and decision conditions with the highest detection accuracy.); and
Di Pietro, Baker, Brown, and Wu are considered to be analogous to the claimed invention because they are in the same field of anomaly detection. In view of the teachings of Di Pietro, Baker, and Brown, it would have been obvious for a person of ordinary skill in the art to apply the teachings of Wu to Di Pietro before the effective filing date of the claimed invention in order to improve the sliding window strategy and optimizing decision conditions, increasing detection accuracy and reducing the false positive rate (cf. Wu, [ABSTRACT, pg. 45233] With the considerable growth of cybersecurity risks in modern automobiles, cybersecurity issues in the in-vehicle network environment have attracted significant attention from security researchers in recent years. Enhancing the cybersecurity ability of in-vehicle networks while considering the computing resource and cost constraints become an urgent issue. To address this problem, a novel information entropy based method is proposed in this paper, which uses a fixed number of messages as sliding windows. By improving the sliding window strategy and optimizing the decision conditions, the detection accuracy is increased and the false positive rate is reduced. Experimental results demonstrate that the proposed method can provide real-time response to attacks with a considerably improved detection precision for intrusion detection in the in-vehicle network environment.).
Regarding claim 3 and analogous claims 14 and 15, Di Pietro, as modified by Baker, Brown, and Wu, teaches The computer-implemented method of claim 1, The non-transitory computer-readable storage medium of claim 12, and The non-transitory computer-readable storage medium of claim 14, respectively.
Wu teaches wherein the sliding window is continuously updated by adding a newly received network traffic vector and removing an oldest network traffic vector to maintain a fixed window size ([III. METHODOLOGIES, pg. 45236] Definition 1: A to maintain a fixed window size window is used to monitor the network information entropy, and it can be fixed time or fixed number of messages. Time and number of messages serve as window parameters. We define it as the sliding window.; [B. FRAMEWORK OF THE PROPOSED METHOD, pg. 45236] Step 3: wherein the sliding window is continuously updated by adding a newly received network traffic vector and removing an oldest network traffic vector use the sliding window as an information entropy sampling window to analyze the information entropy of the message IDs captured within the sliding window. • Step 4: compare the information entropy obtained in Step 3 with the range of normal information entropy to determine whether there is an attack block. • Step 5: compare the attack result obtained in Step 4 with the tag of the added attack block, and obtain the initial detection accuracy data.).
Di Pietro, Baker, Brown, and Wu are combinable for the same rationale as set forth above with respect to claim 1.
Regarding claim 5 and analogous claim 16, Di Pietro, as modified by Baker, Brown, and Wu, teaches The computer-implemented method of claim 1 and The non-transitory computer-readable storage medium of claim 12, respectively.
Brown teaches wherein the first machine learning model and the second machine learning model each comprise respective neural networks trained using different subsets of network traffic vectors ([0104] In at least one embodiment, semi-supervised learning may be used, which is a technique in which in training dataset 1002 includes a mix of labeled and unlabeled data. In at least one embodiment, training framework 1004 may be used to perform incremental learning, such as through transferred learning techniques. In at least one embodiment, incremental learning enables trained neural network 1008 to adapt to new dataset 1012 without forgetting knowledge instilled within trained neural network 1008 during initial training.; [0523] In at least one embodiment, applications available for deployment pipelines 3910 may include any application that may be used for performing processing tasks on imaging data or other data from devices. In at least one embodiment, different applications may be responsible for image enhancement, segmentation, reconstruction, anomaly detection, object detection, feature detection, treatment planning, dosimetry, beam planning (or other radiation treatment procedures), and/or other analysis, image processing, or inferencing tasks.; [0078] In at least one embodiment, a different pre-trained model different from an average model 404 is used, such as a model that is calculated differently, a first machine learning model and the second machine learning model each comprise respective neural networks trained using different subsets of network traffic vectors model that is trained using different training data, a different type of model trained to perform a same task (e.g., classification) or otherwise another neural network that is different from a neural network being trained.; [0103] In at least one embodiment, unsupervised training can also be used to perform anomaly detection, which allows identification of data points in new dataset 1012 that deviate from normal patterns of new dataset 1012.).
Di Pietro, Baker, Brown, and Wu are combinable for the same rationale as set forth above with respect to claim 1.
Regarding claim 6 and analogous claim 17, Di Pietro, as modified by Baker, Brown, and Wu, teaches The computer-implemented method of claim 1 and The non-transitory computer-readable storage medium of claim 12, respectively.
Baker teaches wherein the first machine learning model is a discriminative classifier and the second machine learning model is a generative classifier that produces probabilistic confidence outputs used in computing the skepticism value ([0162] In some embodiments, block 121 uses the MGM illustrated in FIGS. 19 and 20. As illustrated in FIG. 20, an MGM contains both second machine learning model is a generative classifier generators and first machine learning model is a discriminative classifier detectors. An MGM can both generate simulated data and classify it.; [0224] The task of classifier 403 is to that produces probabilistic confidence outputs used in computing the skepticism value distinguish data generated by generator 401 from data generated by generator 402. For other embodiments in which there are more than two generators, the task of the classifier 403 can be expressed more generally as being to determine which generator from the set of generators produced the given data. Generator 401 and generator 402 generate training and development data to train classifier 403.).
Di Pietro, Baker, Brown, and Wu are combinable for the same rationale as set forth above with respect to claim 1.
Regarding claim 7 and analogous claim 18, Di Pietro, as modified by Baker, Brown, and Wu, teaches The computer-implemented method of claim 1 and The non-transitory computer-readable storage medium of claim 12, respectively.
Baker teaches wherein determining the skepticism value comprises computing a confidence divergence metric between probability distributions generated by the first and second machine learning models for each network traffic vector ([0178] In situation one, data example X is distorted or transformed in some way such that there are multiple examples of category B that are similar to X. This situation may be detected, for example, by the determining the skepticism value comprises computing a confidence divergence metric confidence estimation system illustrated in FIG. 1G. For example, the system in FIG. 1G might determine that the classification as category B has high confidence and that, in addition, the internal score for how well example X matches category B ranks acceptably in the distribution of such scores for true examples of category B.; [0192] The illustrative embodiment of FIG. 1G has several significant properties: (1) between probability distributions generated by the first and second machine learning models for each network traffic vector The final confidence estimate is based one or more confidence estimates (1G03 and 1G05); (2) The confidence estimate is defined and computed not as an absolute measure, but as an estimate with respect to a specified source of data 1G01; (3) The confidence estimate for a system operating as a classifier is a distinct concept from the confidence estimate of the same or a different system operating as a detector; (4) The confidence rating for a detector is also conditional on a specified source of background data 1G08; (5) The confidence estimate uses observations of the internal state of the classifier or detector 1G02 as well as its output scores and the data being classified; (6) The confidence estimator 1G05 may send cost function derivative feedback to auxiliary outputs (1G06 and 1G07) of the classifier or detector 1G02; (7) The classifier or detector 1G02 may use gradient descent to optimize the auxiliary outputs based on the cost function feedback from confidence estimator 1G05; (8) The confidence estimation system 1G05 may also compute other useful statistics and make them available.).
Di Pietro, Baker, Brown, and Wu are combinable for the same rationale as set forth above with respect to claim 1.
Regarding claim 8 and analogous claim 19, Di Pietro, as modified by Baker, Brown, and Wu, teaches The computer-implemented method of claim 7 and The non-transitory computer-readable storage medium of claim 18, respectively.
Baker teaches wherein: retraining only the first machine learning model using the selected skepticism vectors comprises adjusting weights of the first machine learning model to reduce classification disagreement with the second model for subsequent network traffic vectors ([0238] Training together as shown in FIG. 4 can help any one of these generator types to avoid its weaknesses and to learn to imitate the strengths of the others. Block 405 enhances the to reduce classification disagreement with the second model for subsequent network traffic vectors process of the two or more generators learning to imitate each other. However, an individual output of a stochastic generator rarely matches another random output, even when the two generators are identical. Embodiments of block 405 operate a constructive iterative matching process. Normal stochastic descent training computes one increment to an estimated gradient for each data example and retraining only the first machine learning model using the selected skepticism vectors comprises adjusting weights of the first machine learning model updates the learned parameters, such as the connection weights in a neural network, once per minibatch.).
Di Pietro, Baker, Brown, and Wu are combinable for the same rationale as set forth above with respect to claim 1.
Claims 2, 11, 13 are rejected under 35 U.S.C. 103 as being unpatentable over Di Pietro, in view of Baker, Brown, Wu, and further in view of Molloy et al. (U.S. Pre-Grant Publication No. 20210287141, hereinafter 'Molloy').
Regarding claim 2 and analogous claims 11 and 13, Di Pietro, as modified by Baker, Brown, and Wu, teaches The computer-implemented method of claim 1, The system of claim 10, and The non-transitory computer-readable storage medium of claim 12, respectively.
Di Pietro, as modified by Baker, Brown, and Wu, fails to teach wherein the skepticism value comprises a difference between confidence scores generated by the first and second machine learning models for a corresponding vector, and wherein selecting the skepticism value vectors comprises comparing the difference to a predetermined threshold.
Molloy teaches wherein the skepticism value comprises a difference between confidence scores generated by the first and second machine learning models for a corresponding vector, and wherein selecting the skepticism value vectors comprises comparing the difference to a predetermined threshold ([0042] For example, the AI models may each output a vector output in which the vector output comprises a plurality of vector slots, each vector slot corresponding to a particular classification or output result. Values in each of the vector slots represent a confidence, or probability, score generated by the first and second machine learning models for a corresponding vector generated by the corresponding AI model indicating the AI model's prediction that the corresponding classification or output result is the correct classification or output result for the input to the AI model.; [0150] The resulting wherein the skepticism value comprises a difference between confidence scores confidence scores or measures are processed by a final confidence merging and ranking stage 670 which compares the confidence scores and measures to each other, wherein selecting the skepticism value vectors comprises comparing the difference to a predetermined threshold compares them against predetermined thresholds, or performs any other analysis on the confidence scores to determine which hypotheses/candidate answers are the most likely to be the correct answer to the input question.).
Di Pietro, Baker, Brown, Wu, and Molloy are considered to be analogous to the claimed invention because they are in the same field of anomaly detection. In view of the teachings of Di Pietro, Baker, Brown, and Wu, it would have been obvious for a person of ordinary skill in the art to apply the teachings of Molloy to Di Pietro before the effective filing date of the claimed invention in order to provide a defensive mechanism that operates based on ensembles of artificial intelligence computer models trained on a same domain (cf. Molloy, [0024] The mechanisms of the illustrative embodiments, rather than focusing on a single artificial intelligence computer model, provides a defensive mechanism that operates based on ensembles of artificial intelligence computer models trained on a same domain. Given that adversarial samples transfer between different artificial intelligence computer models, or machine learning computer models, including different architectures, the solution of the illustrative embodiments is to prevent these adversarial samples from transferring between the artificial intelligence/machine learning computer models (hereafter simply referred to as “AI models” or “models”). The term adversarial sample, also referred to as an adversarial example, refers to inputs to AI models that an attacker has intentionally designed to cause the model to make a mistake. To ensure that adversarial samples are prevented from transferring, as described hereafter, the mechanisms of the illustrative embodiments implement an ensemble of two or more models which are trained such that the errors (regions exploited to create adversarial samples) are different while maximizing the benign accuracy.).
Claim 4 is rejected under 35 U.S.C. 103 as being unpatentable over Di Pietro, in view of Baker, Brown, Wu, and further in view of Raghavendra et al. (U.S. Pre-Grant Publication No. 20210336977, hereinafter 'Raghavendra').
Regarding claim 4, Di Pietro, as modified by Baker, Brown, and Wu, teaches The computer-implemented method of claim 1.
Di Pietro, as modified by Baker, Brown, and Wu, fails to teach wherein the network security appliance applies the retrained first machine learning model to classify real time packet streams into malicious and non-malicious categories to control network access.
Raghavendra teaches wherein the network security appliance applies the retrained first machine learning model to classify real time packet streams into malicious and non-malicious categories to control network access ([0054] The method, system, and computer program product also comprises: at 108, in response to and non-malicious categories to control network access detecting that the data packet is non-malicious based on the packet and traffic analysis, releasing, at 110, the processed data packet from the sandbox environment for further processing in the processing environment, and in response to classify real time packet streams into malicious and detecting that the data packet is malicious based on the packet and traffic analysis, 112, discarding, 114, the data packet. This deletion process may at least be performed in the sandbox environment. In the other case (i.e., in the non-malicious case), the results and data transformation performed in the sandbox environment may be used during the further processing.; [0078] 4. For new network traffic detected, further workflow for deep packet inspection is triggered. The network traffic will be decrypted and checked against YARA rules (which is a wherein the network security appliance applies the retrained first machine learning model modelling and description language for an identification and classification of malware) and other known malware patterns and signatures.).
Di Pietro, Baker, Brown, Wu, and Raghavendra are considered to be analogous to the claimed invention because they are in the same field of anomaly detection. In view of the teachings of Di Pietro, Baker, Brown, and Wu, it would have been obvious for a person of ordinary skill in the art to apply the teachings of Raghavendra to Di Pietro before the effective filing date of the claimed invention in order to detect and terminate a chain of network traffic and processes triggered by malicious network traffic (cf. Raghavendra, [0037] The present embodiment may also introduce a workflow to retroactively detect and terminate a chain of network traffic and processes triggered by malicious network traffic. Overall, security for endpoint devices or endpoint processing environments in general may be enhanced and network latency due to security inspections can be reduced significantly.).
Claims 9, 20 are rejected under 35 U.S.C. 103 as being unpatentable over Di Pietro, in view of Baker, Brown, Wu, and further in view of Mantripragada et al. (U.S. Pre-Grant Publication No. 20090103524, hereinafter 'Mantripragada').
Regarding claim 9 and analogous claim 20, Di Pietro, as modified by Baker, Brown, and Wu, teaches The computer-implemented method of claim 7 and The non-transitory computer-readable storage medium of claim 18, respectively.
Di Pietro, as modified by Baker, Brown, and Wu, fails to teach the method further comprising: deploying the retrained first machine learning model within the network security appliance to perform real time packet inspection, wherein packets classified as malicious are blocked or quarantined.
Mantripragada teaches the method further comprising: deploying the retrained first machine learning model within the network security appliance to perform real time packet inspection, wherein packets classified as malicious are blocked or quarantined ([0034] In addition, UCTM system 105 meets real-time traffic needs of the UC services. As a result, UCTM system 105 combines security services for data and voice to provide not only comprehensive protection against a plethora of voice, video and multimedia IP threats but also complete control and visibility of real-time traffic.; [0127] deploying the retrained first machine learning model within the network security appliance to perform real time packet inspection Decision engine 520 adopts a Unified Threat Assessment (UTA) methodology to correlate various meta information passed from different modules and engines (e.g., analysis modules 511-516, inspection engines 531-536) to detect malicious activities with high fidelity. Decision engine 520 makes a decision whether to wherein packets classified as malicious are blocked or quarantined allow (521), deny (522), quarantine (523), or redirect (524) flow streams. According to one embodiment, users can configure options for making a decision. For example, an administrator may configure the system to allow all communication traffics coming from only a specific type of endpoints (e.g., Ploycom-SZ-Ver2.0).; [0128] According to one embodiment, advanced algorithms such as support vector mechanics (SVM), fuzzy logic, Bayesian algorithms, and system correlation are used to identify the sources of malicious attacks.).
Di Pietro, Baker, Brown, Wu, and Mantripragada are considered to be analogous to the claimed invention because they are in the same field of anomaly detection. In view of the teachings of Di Pietro, Baker, Brown, and Wu, it would have been obvious for a person of ordinary skill in the art to apply the teachings of Mantripragada to Di Pietro before the effective filing date of the claimed invention in order to make a decision to allow, deny, quarantine or redirect the message based on analysis (cf. Mantripragada, [0011] A system and method to precisely learn and enforce security rules for Unified Communication (UC) applications and endpoints is disclosed. According to one embodiment, a behavioral learning system learns and abstracts positive flow behaviors of UC applications and endpoints. The properties of previously received messages from the endpoints and learned behaviors of the plurality of endpoints are stored in a database. A message from a endpoint is received by a message scanner and correlated with the AOR records in the database. The message is classified into one of a whitelist, a blacklist, and a graylist based on the results of analysis by the analysis engine. The whitelist contains the AOR records that are legitimate, the blacklist contains the AOR records that are a potential attack, and the graylist contains the AOR records that belong to neither the whitelist nor the blacklist. Based on the analysis and inspection of the message in light of the learned behaviors, a decision is made to allow, deny, quarantine or redirect the message.).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MAGGIE MAIDO whose telephone number is (703) 756-1953. The examiner can normally be reached M-Th: 6am - 4pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Michael Huntley can be reached on (303) 297-4307. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information Regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MM/Examiner, Art Unit 2129
/MICHAEL J HUNTLEY/Supervisory Patent Examiner, Art Unit 2129
