Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
DETAILED ACTION
This action is in response to applicant’s original submittal made on 02/28/2022. Claims 1-12 are pending.
Specification (Title)
The title of the invention is not descriptive. A new title is required that is clearly indicative of the invention to which the claims are directed.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1, 2, 7 and 8 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention. The examiner contends that the metes and bound of applicant's claim limitation(s) elements of, "likelihood", cannot be readily determined. The examiner notes that the claim language of, "likelihood", creates uncertainty about what is being claimed.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-4 are rejected under 35 U.S.C. 103 as being unpatentable over Wittenschlaeger (US Patent Publication No. 2012/0131674) in view of Birdwell et al. (US Patent Publication No. 2013/0054603 and Birdwell hereinafter).
As to claim 1, Wittenschlaeger system for data compliance and protection with threat detection and response, comprising:
a computing device comprising a processor and a memory (i.e., …teaches in par. 0022 the following: “Each node 130 can include processors, memory, ports, or other apparatus components that can be individually assigned to data”);
an activity monitoring engine comprising a first plurality of programming instructions stored in the memory and operating on the processor (i.e., …teaches in par. 0040 the following: “Step 353 can include networking nodes collecting or otherwise obtaining vectors of behavior metrics that can be analyzed in real-time relative to the anomaly criterion present at the node. Obtaining the behavior metrics can include measuring metrics locally, calculating behavior metrics, reading sensors, accessing the memory or black box for historical data, exchanging behavior metrics or criterion status with other nodes, or any other type of collecting data”),
wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to (i.e. …teaches in par. 0018 the following: “computing devices comprise a processor configured to execute software instructions stored on a tangible, non-transitory computer readable storage medium (e.g., hard drive, solid state drive, RAM, flash, ROM, etc.).”):
generate expected behavior data of a plurality of connected resources by applying a behavioral model to each node of a cyber-physical graph (i.e., …teaches in par. 0044 the following: “compiled statistic reflecting nominal behavior relative to historical anomalous behavior (e.g., compiled from modeling or simulating anomalous behaviors).” …teaches in par. 0030 the following: “Baseline vectors can take on many different forms. A baseline vector can represent an overall nominal behavior of a fabric as well as different types of nominal behavior.”.);
and send the expected behavior data to an action outcome simulation module (I.e., …teaches in par. 0034 the following: “Modeling the fabric is contemplated to provide more accurate results over a simulation.”);
the action outcome simulation module comprising a second plurality of programming instructions stored in the memory and operating on the processor (i.e., …teaches in par. 0033 the following: “the simulation can be deployed on one or more of the networking nodes.”),
wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to: receive expected behavior data from the activity monitoring engine (…teaches in par. 0030 the following: “Baseline vectors can take on many different forms. A baseline vector can represent an overall nominal behavior of a fabric as well as different types of nominal behavior.”);
determine unexpected actions of a plurality of connected resources via a plurality of simulations using the expected behavior data (i.e., …teaches in par. 0034 the following: “simulating and modeling the fabric can be used to derive anomaly detection criteria.”);
and a risk analyzer comprising a third plurality of programming instructions stored in the memory and operating on the processor (i.e., …teaches in par. 0044 the following: “Such information can be useful to fabric managers so the managers can address possible risks or take pre-emptive actions.”),
determine an impact of each potential threat posed by the identified sequences with respect to a set of data compliance rules (i.e., …teaches in par. 0033 the following: “Such an approach allows for gaining an understanding of how an anomalous behavior affects vectors of behavior metrics without substantially impacting the fabric in general.” …teaches in par. 0034 the following: “An anomalous behavior can be introduced or injected into the modeled fabric, and then the effects can be directly observed in a more accurate real-world environment.”);
and initiate a response to any identified sequences that meet the threshold for immediate action based on the impact and likelihood of the potential threat (i.e., …teaches in par. 0031 the following: “If the Chi-Squire value exceeds a threshold, an anomalous behavior might be present. It should be appreciate that temporal properties can be incorporated in the measurement of the variation. All vector-based variation functions are contemplated.”).
The system of Wittenschlaeger does not expressly teach:
and produce a hypothetical behavior graph representing the unexpected actions to or by the plurality of connected resources, wherein: the connected resources comprise one or more of people, devices, systems, and organizations within or out of an organization's network;
the hypothetical behavior graph comprises action nodes representing one or more of the connected resources and an action either to or by the connected resource, and wherein all action nodes but the last action node in a sequence has succeeding action node representing one or more of the connected resources and another action made possible by the preceding node's action;
and the hypothetical behavior graph comprises edges representing the logical or physical relationships between the action nodes and weighted by a likelihood and an impact of the preceding action node's action;
wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to: compare a real-time stream of actions of the connected resources against the hypothetical behavior graph identifying any sequence of action nodes that are unexpected and lead to a potential threat.
In this instance the examiner notes the teachings of prior art reference Birdwell.
With regards to applicant’s claim limitation element of “and produce a hypothetical behavior graph representing the unexpected actions to or by the plurality of connected resources, wherein: the connected resources comprise one or more of people, devices, systems, and organizations within or out of an organization's network”, teaches in par. 0078 the following: “With respect to data mining, the method can be used to mine information in a database--looking for clusters of similar behaviors. This can be purchasing patterns of consumers, or of businesses (e.g., raw materials). A model can be applied to some or all of the members of a cluster (similar objects) to determine their relationship. The model can be a Bayesian or belief network, or a pedigree, which is a graph of hypothetical relationships between objects. Relationships can be flows of capital or goods/services between members of a cluster (or a subset of a cluster). Multiple hypothesis testing or maximum likelihood estimation can be used to determine which relationships (models) are more (or which is most) likely. Similarity-based search can determine objects in a database that are most similar to a target, or objects most similar to each other. By exploiting the high speed of the database, one can perform a search of the database against itself to determine a list of the most similar clusters or subsets of objects and apply models to these to test hypotheses. The results of this procedure can be used to add information to the database, which could be "metadata", or data about the data (clusters), mining the database for knowledge.”.
With regards to applicant’s claim limitation element of, “the hypothetical behavior graph comprises action nodes representing one or more of the connected resources and an action either to or by the connected resource, and wherein all action nodes but the last action node in a sequence has succeeding action node representing one or more of the connected resources and another action made possible by the preceding node's action”, teaches in par. 0078 the following: “With respect to data mining, the method can be used to mine information in a database--looking for clusters of similar behaviors. This can be purchasing patterns of consumers, or of businesses (e.g., raw materials). A model can be applied to some or all of the members of a cluster (similar objects) to determine their relationship. The model can be a Bayesian or belief network, or a pedigree, which is a graph of hypothetical relationships between objects. Relationships can be flows of capital or goods/services between members of a cluster (or a subset of a cluster). Multiple hypothesis testing or maximum likelihood estimation can be used to determine which relationships (models) are more (or which is most) likely. Similarity-based search can determine objects in a database that are most similar to a target, or objects most similar to each other. By exploiting the high speed of the database, one can perform a search of the database against itself to determine a list of the most similar clusters or subsets of objects and apply models to these to test hypotheses. The results of this procedure can be used to add information to the database, which could be "metadata", or data about the data (clusters), mining the database for knowledge.”.
With regards to applicant’s claim limitation element of, “and the hypothetical behavior graph comprises edges representing the logical or physical relationships between the action nodes and weighted by a likelihood and an impact of the preceding action node's action”, teaches in par. 0078 the following: “With respect to data mining, the method can be used to mine information in a database--looking for clusters of similar behaviors. This can be purchasing patterns of consumers, or of businesses (e.g., raw materials). A model can be applied to some or all of the members of a cluster (similar objects) to determine their relationship. The model can be a Bayesian or belief network, or a pedigree, which is a graph of hypothetical relationships between objects. Relationships can be flows of capital or goods/services between members of a cluster (or a subset of a cluster). Multiple hypothesis testing or maximum likelihood estimation can be used to determine which relationships (models) are more (or which is most) likely. Similarity-based search can determine objects in a database that are most similar to a target, or objects most similar to each other. By exploiting the high speed of the database, one can perform a search of the database against itself to determine a list of the most similar clusters or subsets of objects and apply models to these to test hypotheses. The results of this procedure can be used to add information to the database, which could be "metadata", or data about the data (clusters), mining the database for knowledge.”.
With regards to applicant’s claim limitation element of, “wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to: compare a real-time stream of actions of the connected resources against the hypothetical behavior graph identifying any sequence of action nodes that are unexpected and lead to a potential threat”, teaches in par. 0078 the following: “With respect to data mining, the method can be used to mine information in a database--looking for clusters of similar behaviors. This can be purchasing patterns of consumers, or of businesses (e.g., raw materials). A model can be applied to some or all of the members of a cluster (similar objects) to determine their relationship. The model can be a Bayesian or belief network, or a pedigree, which is a graph of hypothetical relationships between objects. Relationships can be flows of capital or goods/services between members of a cluster (or a subset of a cluster). Multiple hypothesis testing or maximum likelihood estimation can be used to determine which relationships (models) are more (or which is most) likely. Similarity-based search can determine objects in a database that are most similar to a target, or objects most similar to each other. By exploiting the high speed of the database, one can perform a search of the database against itself to determine a list of the most similar clusters or subsets of objects and apply models to these to test hypotheses. The results of this procedure can be used to add information to the database, which could be "metadata", or data about the data (clusters), mining the database for knowledge.”.
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to implement the teachings of Wittenschlaeger with the teachings of Birdwell by having their system comprise an enhanced data analysis process. One would have been motivated to do so to provide simple and effective means to detect data anomalies, wherein the enhanced data analysis process helps facilitate thorough data analysis and makes it easier to predict trends in data.
As to claim 2, the system of Wittenschlaeger and Birdwell as applied to claim 1 above teaches intrusion detection, specifically Wittenschlaeger teaches a system of claim 1, further comprising a scoring engine comprising a fourth plurality of programming instructions stored in the memory and operating on the processor, wherein the fourth plurality of programming instructions, when operating on the processor, cause the computing device to generate a risk score for each affected connected resource using the impact and likelihood of the identified sequences (i.e., .. teaches in par. 0034 the following: “An anomalous behavior can be introduced or injected into the modeled fabric, and then the effects can be directly observed in a more accurate real-world environment. …teaches in par 0044 the following: “can be useful to fabric managers so the managers can address possible risks or take pre-emptive actions”. …teaches in par. 0044 the following: “At step 375 based on the level of satisfaction of the anomaly criteria or the collected criterion status, one can generate a likelihood of the anomalous behavior is about to occur.”).
As to claim 3, the system of Wittenschlaeger and Birdwell as applied to claim 2 above teaches intrusion detection, specifically Wittenschlaeger teaches a system of claim 2, wherein the scoring engine further causes the computing device to display the risk score in text and graphical form (i.e., …teaches in par. 0044 the following: “At step 375 based on the level of satisfaction of the anomaly criteria or the collected criterion status, one can generate a likelihood of the anomalous behavior is about to occur. …The likelihood can represent a probability that the anomalous behavior might occur. In some embodiments, the likelihood can be calculated based on compiled statistic reflecting nominal behavior relative to historical anomalous behavior (e.g., compiled from modeling or simulating anomalous behaviors). Such information can be useful to fabric managers so the managers can address possible risks or take pre-emptive actions. …teaches in par. 0051 the following: “a graphical representation 400 of two correlated metrics in a baseline vector. The metrics have a moderately strong correlation as shown where a first metric monotonically increases with respect to the second metric. The two metrics can compose a baseline vector, which can also include a derived relationship between the two metrics (e.g., a trend). Through observation of a nominal behavior represented by correlation 410, anomaly detection criteria 420 are derived as a function of variation 430 around correlation 410. Detection criteria 420 are illustrated as an envelope around correlation 410. The envelope could include contours represent degrees of detection where criteria 420 can be partially satisfied. When a current behavior varies away from the baseline, as indicated by the variation arrow, detection criteria 420 can be checked. If variation 430 satisfies the anomaly criteria then an anomalous behavior is considered to (a) have occurred, (b) is occurring, or (c) is about to occur according the conditions set forth in the criteria.”.).
As to claim 4, the system of Wittenschlaeger and Birdwell as applied to claim 1 above teaches intrusion detection, specifically Wittenschlaeger teaches a system of claim 1, wherein the response is a virtual compartmentalization of one or more of the connected resources that is potentially comprised (i.e., …illustrates in figure 1 virtual connected resources and possible threats).
Claim(s) 5 and 6 are rejected under 35 U.S.C. 103 as being unpatentable over Wittenschlaeger in view of Birdwell as applied to claim 1 above and further in view of Rathor et al. (US Patent No. 10,027,689 and Rathor hereinafter).
As to claim 5, the system of Wittenschlaeger and Birdwell as applied to claim 1 above teaches intrusion detection, specifically Wittenschlaeger teaches a system of claim 1, further comprising an observation and state estimation module comprising a fifth plurality of programming instructions stored in the memory and operating on the processor (i.e., …teaches in par. 0022 the following: “Each node 130 can include processors, memory, ports, or other apparatus components that can be individually assigned to data”), wherein the fifth plurality of programming instructions, when operating on the processor, cause the computing device to (i.e., …teaches in par. 0022 the following: “Each node 130 can include processors, memory, ports, or other apparatus components that can be individually assigned to data”):
monitor the plurality of connected resources on the network (i.e. …teaches in par. 010 the following: “A better approach to would be to monitor a fabric behavior with respect to a vector of behavior metrics where the metrics can be weakly correlated, strongly correlated, or lack correlation. Each network node can locally monitor one or more vectors of behavior metrics relating to an anomaly criterion”).
The system of Wittenschlaeger and Birdwell does not expressly teach:
and produce the cyber-physical graph representing the plurality of connected resources, wherein: the connected resources comprise one or more of people, devices, systems, and organizations within the network;
the cyber-physical graph comprises nodes representing the connected resources, which each node having one or more properties containing descriptive information for the connected resource represented by that node;
and the cyber-physical graph comprises edges representing the logical relationships between the plurality of connected resources and the physical relationships between any connected resources comprising a hardware device.
In this instance the examiner notes the teachings of prior art reference Rathor.
With regards to applicant’s claim limitation element of “and produce the cyber-physical graph representing the plurality of connected resources, wherein: the connected resources comprise one or more of people, devices, systems, and organizations within the network”, teaches in col. 7 lines 25-35 the following: “…the MDVS receives data describing observed events from one or more sources connected to a network. The sources may include one or more endpoint devices, one or more threat detection systems (TDSes) and/or cloud computing services. The received data may provide one or more particulars of the observed events and/or describe relationships between the observed events.”.
With regards to applicant’s claim limitation element of, “the cyber-physical graph comprises nodes representing the connected resources, which each node having one or more properties containing descriptive information for the connected resource represented by that node”, teaches in col. 3, lines 10-30 the following: “The malware detection and visualization system also includes a user interface rendering subsystem that generates interactive display screens from the interactive display screen information and allows security personnel to select displayed malicious events in order to acquire additional information concerning such events as well as generate an alert or a (malware) signature that may be used for subsequent detection of malware associated with these malicious events. The interactive display screens provide a network administrator with a visual representation that compares a reference model of events (e.g., known exploits) and the relationships connecting the events with a group of potentially malicious events and their relationships to one another. The group of potentially malicious events may be derived from observations of endpoint devices, threat detection systems and/or cloud computing services connected to the malware detection and visualization system over a network.”.
With regards to applicant’s claim limitation element of, “and the cyber-physical graph comprises edges representing the logical relationships between the plurality of connected resources and the physical relationships between any connected resources comprising a hardware device”, teaches in col. 7 lines 25-35 the following: “…the MDVS receives data describing observed events from one or more sources connected to a network. The sources may include one or more endpoint devices, one or more threat detection systems (TDSes) and/or cloud computing services. The received data may provide one or more particulars of the observed events and/or describe relationships between the observed events.”.
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to implement the teachings of Wittenschlaeger and Birdwell with the teachings of Rathor by having their system comprise an enhanced data modeling process. One would have been motivated to do so to provide simple and effective means to detect network exploits, wherein the enhanced data modeling process helps facilitate fast anomaly detection and makes it easier to carry out a data comparison process.
As to claim 6, the system of Wittenschlaeger and Birdwell as applied to claim 1 above teaches intrusion detection, specifically Wittenschlaeger teaches a system of claim 1, wherein the activity monitoring engine further causes the computing device to:
store the expected behavior data for a node as the one or more properties of that node in the
stream in real-time the actual behavior data of the connected resources within and out of the network to the risk analyzer (i.e., …teaches in par. 0044 the following: “At step 375 based on the level of satisfaction of the anomaly criteria or the collected criterion status, one can generate a likelihood of the anomalous behavior is about to occur. …The likelihood can represent a probability that the anomalous behavior might occur. In some embodiments, the likelihood can be calculated based on compiled statistic reflecting nominal behavior relative to historical anomalous behavior (e.g., compiled from modeling or simulating anomalous behaviors). Such information can be useful to fabric managers so the managers can address possible risks or take pre-emptive actions);
detect deviations of the actual behavior data from the expected behavior data by comparing the expected behavior data properties of each node with the actual behavior properties of that node (i.e., …teaches in par. 0026 the following: “or detecting an anomalous behavior within a fabric based on one or more measured vectors of behavior metrics as compared to vectors representing nominal behavior.”);
and when deviations are detected, send information about the deviation to the risk analyzer and the scoring engine (i.e., ……teaches in par. 0051 the following: “a graphical representation 400 of two correlated metrics in a baseline vector. The metrics have a moderately strong correlation as shown where a first metric monotonically increases with respect to the second metric. The two metrics can compose a baseline vector, which can also include a derived relationship between the two metrics (e.g., a trend). Through observation of a nominal behavior represented by correlation 410, anomaly detection criteria 420 are derived as a function of variation 430 around correlation 410. Detection criteria 420 are illustrated as an envelope around correlation 410. The envelope could include contours represent degrees of detection where criteria 420 can be partially satisfied. When a current behavior varies away from the baseline, as indicated by the variation arrow, detection criteria 420 can be checked. If variation 430 satisfies the anomaly criteria then an anomalous behavior is considered to (a) have occurred, (b) is occurring, or (c) is about to occur according the conditions set forth in the criteria.”).
The system of Wittenschlaeger and Birdwell does not expressly teach a cyber-physical graph.
In this instance the examiner notes the teachings of prior art reference Rathor.
Rathor teaches in col. 7 lines 25-35 the following: “…the MDVS receives data describing observed events from one or more sources connected to a network. The sources may include one or more endpoint devices, one or more threat detection systems (TDSes) and/or cloud computing services. The received data may provide one or more particulars of the observed events and/or describe relationships between the observed events.”. Rathor teaches in col. 3, lines 10-30 the following: “The malware detection and visualization system also includes a user interface rendering subsystem that generates interactive display screens from the interactive display screen information and allows security personnel to select displayed malicious events in order to acquire additional information concerning such events as well as generate an alert or a (malware) signature that may be used for subsequent detection of malware associated with these malicious events. The interactive display screens provide a network administrator with a visual representation that compares a reference model of events (e.g., known exploits) and the relationships connecting the events with a group of potentially malicious events and their relationships to one another. The group of potentially malicious events may be derived from observations of endpoint devices, threat detection systems and/or cloud computing services connected to the malware detection and visualization system over a network.”.
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to implement the teachings of Wittenschlaeger and Birdwell with the teachings of Rathor by having their system comprise an enhanced data modeling process. One would have been motivated to do so to provide simple and effective means to detect network exploits, wherein the enhanced data modeling process helps facilitate fast anomaly detection and makes it easier to carry out a data comparison process.
Claim(s) 7-12 are rejected under 35 U.S.C. 103 as being unpatentable over Wittenschlaeger in view of Birdwell further in view of Rathor.
As to claim 7, Wittenschlaeger teaches a method for data compliance and protection with threat detection and response, comprising the steps of:
generating expected behavior data of a plurality of connected resources by applying a behavioral model to each node of a the memory or black box for historical data, exchanging behavior metrics or criterion status with other nodes, or any other type of collecting data”);
determining unexpected actions of a plurality of connected resources via a plurality of simulations using the expected behavior data (i.e., …teaches in par. 0026 the following: “or detecting an anomalous behavior within a fabric based on one or more measured vectors of behavior metrics as compared to vectors representing nominal behavior.”);
determining an impact of each potential threat posed by the identified sequences with respect to a set of data compliance rules (i.e., …teaches in par. 0033 the following: “Such an approach allows for gaining an understanding of how an anomalous behavior affects vectors of behavior metrics without substantially impacting the fabric in general.” …teaches in par. 0034 the following: “An anomalous behavior can be introduced or injected into the modeled fabric, and then the effects can be directly observed in a more accurate real-world environment.”);
and initiating a response to any identified sequences that meet the threshold for immediate action based on the impact and likelihood of the potential threat (i.e., …teaches in par. 0031 the following: “If the Chi-Squire value exceeds a threshold, an anomalous behavior might be present. It should be appreciate that temporal properties can be incorporated in the measurement of the variation. All vector-based variation functions are contemplated.”).
The system of Wittenschlaeger does not expressly teach:
the hypothetical behavior graph comprises action nodes representing one or more of the connected resources and an action either to or by the connected resource, and wherein all action nodes but the last action node in a sequence has succeeding action node representing one or more of the connected resources and another action made possible by the preceding node's action;
and the hypothetical behavior graph comprises edges representing the logical or physical relationships between the action nodes and weighted by a likelihood and an impact of the preceding action node's action;
comparing a real-time stream of actions of the connected resources against the hypothetical behavior graph identifying any sequence of action nodes that are unexpected and lead to a potential threat,
producing a hypothetical behavior graph representing the unexpected actions on or of the plurality of connected resources, wherein: the connected resources comprise one or more of people, devices, systems, and organizations within or out of an organization's network.
In this instance the examiner notes the teachings of prior art reference Birdwell.
With regards to applicant’s claim limitation element of “the hypothetical behavior graph comprises action nodes representing one or more of the connected resources and an action either to or by the connected resource, and wherein all action nodes but the last action node in a sequence has succeeding action node representing one or more of the connected resources and another action made possible by the preceding node's action”, teaches in par. 0078 the following: “With respect to data mining, the method can be used to mine information in a database--looking for clusters of similar behaviors. This can be purchasing patterns of consumers, or of businesses (e.g., raw materials). A model can be applied to some or all of the members of a cluster (similar objects) to determine their relationship. The model can be a Bayesian or belief network, or a pedigree, which is a graph of hypothetical relationships between objects. Relationships can be flows of capital or goods/services between members of a cluster (or a subset of a cluster). Multiple hypothesis testing or maximum likelihood estimation can be used to determine which relationships (models) are more (or which is most) likely. Similarity-based search can determine objects in a database that are most similar to a target, or objects most similar to each other. By exploiting the high speed of the database, one can perform a search of the database against itself to determine a list of the most similar clusters or subsets of objects and apply models to these to test hypotheses. The results of this procedure can be used to add information to the database, which could be "metadata", or data about the data (clusters), mining the database for knowledge.”.
With regards to applicant’s claim limitation element of, “and the hypothetical behavior graph comprises edges representing the logical or physical relationships between the action nodes and weighted by a likelihood and an impact of the preceding action node's action”, teaches in par. 0078 the following: “With respect to data mining, the method can be used to mine information in a database--looking for clusters of similar behaviors. This can be purchasing patterns of consumers, or of businesses (e.g., raw materials). A model can be applied to some or all of the members of a cluster (similar objects) to determine their relationship. The model can be a Bayesian or belief network, or a pedigree, which is a graph of hypothetical relationships between objects. Relationships can be flows of capital or goods/services between members of a cluster (or a subset of a cluster). Multiple hypothesis testing or maximum likelihood estimation can be used to determine which relationships (models) are more (or which is most) likely. Similarity-based search can determine objects in a database that are most similar to a target, or objects most similar to each other. By exploiting the high speed of the database, one can perform a search of the database against itself to determine a list of the most similar clusters or subsets of objects and apply models to these to test hypotheses. The results of this procedure can be used to add information to the database, which could be "metadata", or data about the data (clusters), mining the database for knowledge.”.
With regards to applicant’s claim limitation element of, “comparing a real-time stream of actions of the connected resources against the hypothetical behavior graph identifying any sequence of action nodes that are unexpected and lead to a potential threat”, teaches in par. 0078 the following: “With respect to data mining, the method can be used to mine information in a database--looking for clusters of similar behaviors. This can be purchasing patterns of consumers, or of businesses (e.g., raw materials). A model can be applied to some or all of the members of a cluster (similar objects) to determine their relationship. The model can be a Bayesian or belief network, or a pedigree, which is a graph of hypothetical relationships between objects. Relationships can be flows of capital or goods/services between members of a cluster (or a subset of a cluster). Multiple hypothesis testing or maximum likelihood estimation can be used to determine which relationships (models) are more (or which is most) likely. Similarity-based search can determine objects in a database that are most similar to a target, or objects most similar to each other. By exploiting the high speed of the database, one can perform a search of the database against itself to determine a list of the most similar clusters or subsets of objects and apply models to these to test hypotheses. The results of this procedure can be used to add information to the database, which could be "metadata", or data about the data (clusters), mining the database for knowledge.”.
With regards to applicant’s claim limitation element of, “producing a hypothetical behavior graph representing the unexpected actions on or of the plurality of connected resources, wherein: the connected resources comprise one or more of people, devices, systems, and organizations within or out of an organization's network”, teaches in par. 0078 the following: “With respect to data mining, the method can be used to mine information in a database--looking for clusters of similar behaviors. This can be purchasing patterns of consumers, or of businesses (e.g., raw materials). A model can be applied to some or all of the members of a cluster (similar objects) to determine their relationship. The model can be a Bayesian or belief network, or a pedigree, which is a graph of hypothetical relationships between objects. Relationships can be flows of capital or goods/services between members of a cluster (or a subset of a cluster). Multiple hypothesis testing or maximum likelihood estimation can be used to determine which relationships (models) are more (or which is most) likely. Similarity-based search can determine objects in a database that are most similar to a target, or objects most similar to each other. By exploiting the high speed of the database, one can perform a search of the database against itself to determine a list of the most similar clusters or subsets of objects and apply models to these to test hypotheses. The results of this procedure can be used to add information to the database, which could be "metadata", or data about the data (clusters), mining the database for knowledge.”.
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to implement the teachings of Wittenschlaeger with the teachings of Birdwell by having their system comprise an enhanced data analysis process. One would have been motivated to do so to provide simple and effective means to detect data anomalies, wherein the enhanced data analysis process helps facilitate thorough data analysis and makes it easier to predict trends in data.
The system of Wittenschlaeger and Birdwell does not expressly teach a cyber-physical graph.
In this instance the examiner notes the teachings of prior art reference Rathor.
Rathor teaches in col. 7 lines 25-35 the following: “…the MDVS receives data describing observed events from one or more sources connected to a network. The sources may include one or more endpoint devices, one or more threat detection systems (TDSes) and/or cloud computing services. The received data may provide one or more particulars of the observed events and/or describe relationships between the observed events.”. Rathor teaches in col. 3, lines 10-30 the following: “The malware detection and visualization system also includes a user interface rendering subsystem that generates interactive display screens from the interactive display screen information and allows security personnel to select displayed malicious events in order to acquire additional information concerning such events as well as generate an alert or a (malware) signature that may be used for subsequent detection of malware associated with these malicious events. The interactive display screens provide a network administrator with a visual representation that compares a reference model of events (e.g., known exploits) and the relationships connecting the events with a group of potentially malicious events and their relationships to one another. The group of potentially malicious events may be derived from observations of endpoint devices, threat detection systems and/or cloud computing services connected to the malware detection and visualization system over a network.”.
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to implement the teachings of Wittenschlaeger and Birdwell with the teachings of Rathor by having their system comprise an enhanced data modeling process. One would have been motivated to do so to provide simple and effective means to detect network exploits, wherein the enhanced data modeling process helps facilitate fast anomaly detection and makes it easier to carry out a data comparison process.
As to claim 8, the system of Wittenschlaeger, Birdwell and Rathor as applied to claim 7 above teaches intrusion detection, specifically Wittenschlaeger teaches a method of claim 7, further comprising the steps of generating a risk score for each affected connected resource using the impact and likelihood of the identified sequences (i.e., ……teaches in par. 0051 the following: “a graphical representation 400 of two correlated metrics in a baseline vector. The metrics have a moderately strong correlation as shown where a first metric monotonically increases with respect to the second metric. The two metrics can compose a baseline vector, which can also include a derived relationship between the two metrics (e.g., a trend). Through observation of a nominal behavior represented by correlation 410, anomaly detection criteria 420 are derived as a function of variation 430 around correlation 410. Detection criteria 420 are illustrated as an envelope around correlation 410. The envelope could include contours represent degrees of detection where criteria 420 can be partially satisfied. When a current behavior varies away from the baseline, as indicated by the variation arrow, detection criteria 420 can be checked. If variation 430 satisfies the anomaly criteria then an anomalous behavior is considered to (a) have occurred, (b) is occurring, or (c) is about to occur according the conditions set forth in the criteria.”.).
As to claim 9, the system of Wittenschlaeger, Birdwell and Rathor as applied to claim 8 above teaches intrusion detection, specifically Wittenschlaeger teaches a method of claim 8, further comprising the steps of displaying the risk score in text and graphical form (i.e., ……teaches in par. 0051 the following: “a graphical representation 400 of two correlated metrics in a baseline vector. The metrics have a moderately strong correlation as shown where a first metric monotonically increases with respect to the second metric. The two metrics can compose a baseline vector, which can also include a derived relationship between the two metrics (e.g., a trend). Through observation of a nominal behavior represented by correlation 410, anomaly detection criteria 420 are derived as a function of variation 430 around correlation 410. Detection criteria 420 are illustrated as an envelope around correlation 410. The envelope could include contours represent degrees of detection where criteria 420 can be partially satisfied. When a current behavior varies away from the baseline, as indicated by the variation arrow, detection criteria 420 can be checked. If variation 430 satisfies the anomaly criteria then an anomalous behavior is considered to (a) have occurred, (b) is occurring, or (c) is about to occur according the conditions set forth in the criteria.”.).
As to claim 10, the system of Wittenschlaeger, Birdwell and Rathor as applied to claim 7 above teaches intrusion detection, specifically Wittenschlaeger teaches a method of claim 7, wherein the response is a virtual compartmentalization of one or more of the connected resources that is potentially comprised (i.e., …illustrates in figure 1 virtual connected resources and possible threats).
As to claim 11, the system of Wittenschlaeger, Birdwell and Rathor as applied to claim 7 above teaches intrusion detection, specifically Wittenschlaeger teaches a method of claim 7, further comprising the steps of:
monitoring the plurality of connected resources on the network (i.e. …teaches in par. 010 the following: “A better approach to would be to monitor a fabric behavior with respect to a vector of behavior metrics where the metrics can be weakly correlated, strongly correlated, or lack correlation. Each network node can locally monitor one or more vectors of behavior metrics relating to an anomaly criterion”).
The system of Wittenschlaeger and Birdwell do not expressly teach:
and producing the cyber-physical graph representing the plurality of connected resources, wherein: the connected resources comprise one or more of people, devices, systems, and organizations within the network;
the cyber-physical graph comprises nodes representing the connected resources, which each node having one or more properties containing descriptive information for the connected resource represented by that node;
and the cyber-physical graph comprises edges representing the logical relationships between the plurality of connected resources and the physical relationships between any connected resources comprising a hardware device.
In this instance the examiner notes the teachings of prior art reference Rathor.
With regards to applicant’s claim limitation element of “and producing the cyber-physical graph representing the plurality of connected resources, wherein: the connected resources comprise one or more of people, devices, systems, and organizations within the network”, teaches in col. 7 lines 25-35 the following: “…the MDVS receives data describing observed events from one or more sources connected to a network. The sources may include one or more endpoint devices, one or more threat detection systems (TDSes) and/or cloud computing services. The received data may provide one or more particulars of the observed events and/or describe relationships between the observed events.”.
With regards to applicant’s claim limitation element of, “the cyber-physical graph comprises nodes representing the connected resources, which each node having one or more properties containing descriptive information for the connected resource represented by that node”, teaches in col. 3, lines 10-30 the following: “The malware detection and visualization system also includes a user interface rendering subsystem that generates interactive display screens from the interactive display screen information and allows security personnel to select displayed malicious events in order to acquire additional information concerning such events as well as generate an alert or a (malware) signature that may be used for subsequent detection of malware associated with these malicious events. The interactive display screens provide a network administrator with a visual representation that compares a reference model of events (e.g., known exploits) and the relationships connecting the events with a group of potentially malicious events and their relationships to one another. The group of potentially malicious events may be derived from observations of endpoint devices, threat detection systems and/or cloud computing services connected to the malware detection and visualization system over a network.”.
With regards to applicant’s claim limitation element of, “and the cyber-physical graph comprises edges representing the logical relationships between the plurality of connected resources and the physical relationships between any connected resources comprising a hardware device”, teaches in col. 7 lines 25-35 the following: “…the MDVS receives data describing observed events from one or more sources connected to a network. The sources may include one or more endpoint devices, one or more threat detection systems (TDSes) and/or cloud computing services. The received data may provide one or more particulars of the observed events and/or describe relationships between the observed events.”.
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to implement the teachings of Wittenschlaeger and Birdwell with the teachings of Rathor by having their system comprise an enhanced data modeling process. One would have been motivated to do so to provide simple and effective means to detect network exploits, wherein the enhanced data modeling process helps facilitate fast anomaly detection and makes it easier to carry out a data comparison process.
As to claim 12, the system of Wittenschlaeger and Birdwell as applied to claim 7 above teaches intrusion detection, specifically Wittenschlaeger teaches a method of claim 7, further comprising the steps of:
storing the expected behavior data for a node as the one or more properties of that node in the
streaming in real-time the actual behavior data of the connected resources within and out of the network to the risk analyzer (i.e., …teaches in par. 0044 the following: “At step 375 based on the level of satisfaction of the anomaly criteria or the collected criterion status, one can generate a likelihood of the anomalous behavior is about to occur. …The likelihood can represent a probability that the anomalous behavior might occur. In some embodiments, the likelihood can be calculated based on compiled statistic reflecting nominal behavior relative to historical anomalous behavior (e.g., compiled from modeling or simulating anomalous behaviors). Such information can be useful to fabric managers so the managers can address possible risks or take pre-emptive actions);
detecting deviations of the actual behavior data from the expected behavior data by comparing the expected behavior data properties of each node with the actual behavior properties of that node (i.e., …teaches in par. 0026 the following: “or detecting an anomalous behavior within a fabric based on one or more measured vectors of behavior metrics as compared to vectors representing nominal behavior.”);
and when deviations are detected, sending information about the deviation to the risk analyzer and the scoring engine (i.e., ……teaches in par. 0051 the following: “a graphical representation 400 of two correlated metrics in a baseline vector. The metrics have a moderately strong correlation as shown where a first metric monotonically increases with respect to the second metric. The two metrics can compose a baseline vector, which can also include a derived relationship between the two metrics (e.g., a trend). Through observation of a nominal behavior represented by correlation 410, anomaly detection criteria 420 are derived as a function of variation 430 around correlation 410. Detection criteria 420 are illustrated as an envelope around correlation 410. The envelope could include contours represent degrees of detection where criteria 420 can be partially satisfied. When a current behavior varies away from the baseline, as indicated by the variation arrow, detection criteria 420 can be checked. If variation 430 satisfies the anomaly criteria then an anomalous behavior is considered to (a) have occurred, (b) is occurring, or (c) is about to occur according the conditions set forth in the criteria.”).
The system of Wittenschlaeger and Birdwell does not expressly teach a cyber-physical graph.
In this instance the examiner notes the teachings of prior art reference Rathor.
Rathor teaches in col. 7 lines 25-35 the following: “…the MDVS receives data describing observed events from one or more sources connected to a network. The sources may include one or more endpoint devices, one or more threat detection systems (TDSes) and/or cloud computing services. The received data may provide one or more particulars of the observed events and/or describe relationships between the observed events.”. Rathor teaches in col. 3, lines 10-30 the following: “The malware detection and visualization system also includes a user interface rendering subsystem that generates interactive display screens from the interactive display screen information and allows security personnel to select displayed malicious events in order to acquire additional information concerning such events as well as generate an alert or a (malware) signature that may be used for subsequent detection of malware associated with these malicious events. The interactive display screens provide a network administrator with a visual representation that compares a reference model of events (e.g., known exploits) and the relationships connecting the events with a group of potentially malicious events and their relationships to one another. The group of potentially malicious events may be derived from observations of endpoint devices, threat detection systems and/or cloud computing services connected to the malware detection and visualization system over a network.”.
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to implement the teachings of Wittenschlaeger and Birdwell with the teachings of Rathor by having their system comprise an enhanced data modeling process. One would have been motivated to do so to provide simple and effective means to detect network exploits, wherein the enhanced data modeling process helps facilitate fast anomaly detection and makes it easier to carry out a data comparison process.
Contact Information
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BRYAN F WRIGHT whose telephone number is (571)270-3826.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Eleni Shiferaw can be reached on (571)272-3867. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BRYAN F WRIGHT/Examiner, Art Unit 2497
