DETAILED ACTION
Status of Claims
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on September 2, 2025 has been entered.
Claims 1-2, 5-9, 12-16 and 19-23 have been amended.
Claims 1-3, 5-10, 12-17 and 19-23 are currently pending and have been examined.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendments
The rejection of claims 1-3, 5-10, 12-17 and 19-23 under 35 USC § 101 is maintained. Please see the Response to Arguments.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-3, 5-10, 12-17 and 19-23 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
As per claim 1 recites “using the one or more I&W cutoff values to generate at least one notification to the heuristic deployment network, the at least one notification associated with the current operational environment of the specified operating system; […] presenting the one or more recommended courses of action to the heuristic deployment network for initiation by the heuristic deployment network within the specified operating system; and performing, by the heuristic deployment network, at least one of the one or more recommended courses of action to control the operating system” Applicant’s disclosure describes in ¶ 0040: “the simulation process 300 involves the use of a heuristic deployment framework 302, which represents an optimization framework that can perform various simulations and identify optimal parameters associated with the simulations” Applicant’s disclosure does not describe “using the one or more I&W cutoff values to generate at least one notification to the heuristic deployment network,” Applicant’s disclosure describes in ¶ 0067: “The one or more identified WV cutoff values may be used to generate one or more notifications for one or more users or a decision engine.” Applicant’s disclosure does not describe “presenting the one or more recommended courses of action to the heuristic deployment network for initiation by the heuristic deployment network within the specified operating system” Applicant’s disclosure describes in ¶ 0067: “the one or more notifications and the one or more recommended courses of action can be presented to the user(s) or the decision engine” see also ¶ 0055. Applicant’s disclosure does not describe “performing, by the heuristic deployment network, at least one of the one or more recommended courses of action to control the operating system” Applicant’s disclosure describes in ¶ 0029: “The decision engine 118 represents a system that can determine whether to initiate or perform the one or more possible courses of action associated with the at least one indication or warning, with or without human intervention or approval.” The same rationales applies to claims 8 and 15. Appropriate correction is required.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claim 1-3, 5-10, 12-17 and 19-23 rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
As per claim 1 recites “performing a plurality of Monte Carlo simulations on an operating system using the heuristic deployment network to generate a plurality of simulation results responsive to the randomized parameters and the I&W cutoff values” Examiner is not clear how the plurality of Monte Carlo simulations are performed on an operating system, when claim 7 describes that “the operating system comprises at least one space-based vehicle”. As per Applicant’s disclosure ¶ 0040 describes the simulation process. The same rationales applies to claims 8 and 15. Appropriate correction is required.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-3, 5-10, 12-17 and 19-23 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more. Per MPEP 2106.03 Eligibility Step 1: The Four Categories of Statutory Subject Matter [R-07.2022]. Step 1 is directed to determining whether or not the claims fall within a statutory class. Herein, claims 1-3, 5-7 and 21 falls within statutory class of a process, claims 8-10, 12-14 and 22 falls within statutory class a machine and claims 19-20 and 23 falls within statutory class of an article of manufacturing. Hence, the claims qualify as potentially eligible subject matter under 35 U.S.C §101. With Step 1 being directed to a statutory category, per MPEP 2106.04 Eligibility Step 2A: Whether a Claim is Directed to a Judicial Exception [R-07.2022].. Step 2 is the two-part analysis from Alice Corp. (also called the Mayo test). The 2019 PEG makes two changes in Step 2A: It sets forth new procedure for Step 2A (called “revised Step 2A”) under which a claim is not “directed to” a judicial exception unless the claim satisfies a two-prong inquiry. The two-prong inquiry is as follows: Prong One: evaluate whether the claim recites a judicial exception (an abstract idea enumerated in the 2019 PEG, a law of nature, or a natural phenomenon). If claim recites an exception, then Prong Two: evaluate whether the claim recites additional elements that integrate the exception into a practical application of the exception. The claim(s) recite(s) the following abstract idea indicated by non-boldface font and additional limitations indicated by boldface font:
Claims 1, 8 and 15:
[at least one processing device configured to]:
generate[ing] a plurality of randomized parameters of an operating system using a heuristic deployment network;
generate[ing] a plurality of indication and warning (I&W) cutoff values representing cutoff values that can be used in a simulation using the heuristic deployment network;
perform[ing] a plurality of Monte Carlo simulations on an operating system using the heuristic deployment network to generate a plurality of simulation results responsive to the randomized parameters and the I&W cutoff values, wherein the each of the simulation results comprise various combinations of the randomized parameters of the operating system and the plurality of indication and warning (I&W) cutoff values each of the various combinations associated with a particular operating environment for the operating system;
store[ing] the simulation results in a simulation database for each of the plurality of Monte Carlo simulations;
score[ing] the simulation results using a fitness function configured within heuristic deployment network;
determine[ing] modifications for the I&W cutoff values responsive to the scoring of the simulation results to improve the simulation results:
update[ing] the I&W cutoff values according to the determined modifications to improve the simulation results;
identify[ing] one or more characteristics associated with a current operational environment of the operating system;
identify[ing] one or more simulation results having one or more characteristics that are similar to or match the one or more characteristics associated with the current operational environment;
identify[ing], from among the plurality of I&W cutoff values, one or more I&W cutoff values associated with the one or more simulation results having the one or more characteristics that are similar to or match the one or more characteristics associated with the current operational environment;
identifying, from among multiple recommended courses of action, one or more recommended courses of action associated with the one or more simulation results having the one or more characteristics that are similar to or match the one or more characteristics associated with the current operational environment s;
us[e/ing] the one or more I&W cutoff values to generate at least one notification to the heuristic deployment network, the at least one notification associated with the current operational environment of the operating system;
dynamically updating the I&W cutoff values based on the one or more recommended courses of action to be performed to enable response to a new scenario in a future simulation;
[initiate] present[ation/ing] of the one or more recommended courses of action to the heuristic deployment network for initiation by the heuristic deployment network within the operating system ; and
perform[ing], by the heuristic deployment network, at least one of the one or more recommended courses of action to control the operating system.
Per Prong One of Step 2A, the identified recitation of an abstract idea falls within at least one of the Abstract Idea Groupings consisting of: Mathematical Concepts, Mental Processes, or Certain Methods of Organizing Human Activity. Particularly, the identified recitation falls within Mental Processes such as concepts performed in the human mind including an observation, evaluation, judgment and opinion and Certain Methods of Organizing Human Activity such as fundamental economic practices or practices including mitigating risk i.e., recommendation of courses of actions based on simulations. Per Prong Two of Step 2A, this judicial exception is not integrated into a practical application because the claim as a whole does not integrate the identified abstract idea into a practical application. The processing device, simulation database and operating system is recited at a high level of generality, i.e., as a generic processing device, simulation database and operating system. This generic processing device, simulation database and operating system is no more than mere instructions to apply the exception using a generic processing device and specified system. Further, processor configured to cause receiving/determining/transmitting data is mere instruction to apply an exception using a generic computer component which cannot integrate a judicial exception into a practical application. Accordingly, this/these additional element(s) does/do not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. Thus, since the claims are directed to the determined judicial exception in view of the two prongs of Step 2A, MPEP 2106.05 Eligibility Step 2B: Whether a Claim Amounts to Significantly More [R-07.2022] is directed to Step 2B. Therein, the additional elements and combinations therewith are examined in the claims to determine whether the claims as a whole amounts to significantly more than the judicial exception. It is noted here that the additional elements are to be considered both individually and as an ordered combination. In this case, the claims each at most comprise additional elements of processing device, simulation database and operating system. Taken individually, the additional limitations each are generically recited and thus does not add significantly more to the respective limitations. Further, executing all the steps/functions by a user/service subsystem is mere instruction to apply an exception using a generic computer component which cannot provide an inventive concept in Step 2B (or, looking back to Step 2A, cannot integrate a judicial exception into a practical application). For further support, the Applicant’s specification supports the claims being directed to use of a generic processing device, simulation database and operating system type structure at ¶ 0033: “The processing device may execute instructions that can be loaded into a memory 210. The processing device 202 includes any suitable number(s) and type(s) of processors or other processing devices in any suitable arrangement.” See also figure 1, ¶ 0030: “The database server 108 operates to store and facilitate retrieval of various information used, generated, or collected by the application server 106 and the user devices 102 a-102 d in the database 110. For example, the database server 108 may store various information in relational database tables or other data structures in the database 110.”.” And ¶ 0018: “The space domain typically involves courses of action that are associated with systems in space. In that domain, objects (such as satellites or other systems)”. Taken as an ordered combination, the claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the limitations are directed to limitations referenced in Alice Corp. that are not enough to qualify as significantly more when recited in a claim with an abstract idea include, as a non-limiting or non-exclusive examples: i. Adding the words "apply it" (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, e.g., a limitation indicating that a particular function such as creating and maintaining electronic records is performed by a computer, as discussed in Alice Corp., 134 S. Ct. at 2360, 110 USPQ2d at 1984 (see MPEP § 2106.05(f)); ii. Simply appending well-understood, routine, conventional activities previously known to the industry, specified at a high level of generality, to the judicial exception, e.g., a claim to an abstract idea requiring no more than a generic computer to perform generic computer functions that are well-understood, routine and conventional activities previously known to the industry, as discussed in Alice Corp., 134 S. Ct. at 2359-60, 110 USPQ2d at 1984 (see MPEP § 2106.05(d)); iii. Adding insignificant extra-solution activity to the judicial exception, e.g., mere data gathering in conjunction with a law of nature or abstract idea such as a step of obtaining information about credit card transactions so that the information can be analyzed by an abstract mental process, as discussed in CyberSource v. Retail Decisions, Inc., 654 F.3d 1366, 1375, 99 USPQ2d 1690, 1694 (Fed. Cir. 2011) (see MPEP § 2106.05(g)); or v. Generally linking the use of the judicial exception to a particular technological environment or field of use, e.g., a claim describing how the abstract idea of hedging could be used in the commodities and energy markets, as discussed in Bilski v. Kappos, 561 U.S. 593, 595, 95 USPQ2d 1001, 1010 (2010) or a claim limiting the use of a mathematical formula to the petrochemical and oil-refining fields, as discussed in Parker v. Flook. The courts have recognized the following computer functions inter alia to be well-understood, routine, and conventional functions when they are claimed in a merely generic manner: performing repetitive calculations; receiving, processing, and storing data (e.g., the present claims); electronically scanning or extracting data; electronic recordkeeping; automating mental tasks (e.g., process/machine for performing the present claims); and receiving or transmitting data (e.g., the present claims). The dependent claims 2-3, 5-7, 9-10, 11-14 and 19-23 do not cure the above stated deficiencies, and in particular, the dependent claims further narrow the abstract idea without reciting additional elements that integrate the exception into a practical application of the exception or providing significantly more than the abstract idea. Claims 2, 9 and 16 further limit the abstract idea that the one or more recommended courses of action are presented in response to determining that at least one of the one or more I&W cutoff values has triggered the at least one notification to the heuristic deployment network (a more detailed abstract idea remains an abstract idea). Claims 3, 10 and 17 further limit the abstract idea by dynamically updating at least one of the one or more I&W cutoff values or at least one of the one or more recommended courses of action based on one or more updated characteristics associated with the current operational environment (a more detailed abstract idea remains an abstract idea). Claims 5, 12 and 19 further limit the abstract idea by performing the plurality of Monte Carlo simulations comprises: obtaining parameters defining each of the simulation results; simulating use of different courses of action for each of the simulation results using different selected I&W cutoff values to generate different simulation results for each simulated scenario; and scoring the simulation results to identify one or more optimal courses of action and one or more optimal I&W cutoff values for each of the simulation results (a more detailed abstract idea remains an abstract idea). Claims 6, 13 and 20 further limit the abstract idea by modifying the selected I&W cutoff values based on the scoring to produce updated I&W cutoff values; and simulating use of the different courses of action for each of the simulation results using the updated cutoff values (a more detailed abstract idea remains an abstract idea). Claims 7 and 14 further limit the abstract idea that the current operational environment comprises a space environment; the operating system comprises at least one space-based vehicle and the one or more recommended courses of action are associated with one or more actions by at least one space-based vehicle (a more detailed abstract idea remains an abstract idea). And claims 21-23 further limit the abstract idea that the one or more characteristics associated with a current operational environment comprise one or more randomized parameters associated with the current operational environment (a more detailed abstract idea remains an abstract idea). The identified recitation of the dependents claims falls within the Mental Processes such as concepts performed in the human mind including an observation, evaluation, judgment and opinion and Certain Methods of Organizing Human Activity such as fundamental economic practices or practices including mitigating risk i.e., recommendation of courses of actions based on simulations. Since there are no elements or ordered combination of elements that amount to significantly more than the judicial exception, the claims are not eligible subject matter under 35 USC §101. Thus, viewed as a whole, these additional claim element(s) do not provide meaningful limitation(s) to transform the abstract idea into a patent eligible application of the abstract idea such that the claim(s) amounts to significantly more than the abstract idea itself. Therefore, the claim(s) are rejected under 35 U.S.C. 101 as being directed to non-statutory subject matter.
Response to Arguments
Applicant's arguments filed on 8/1/2025 have been fully considered but they are not persuasive.
With regard to the 35 U.S.C. 101 rejection, Applicant argues that (1) “Applicant’s claims are clearly directed to a practical application” and claim 1 is similar to Example 48 (Remarks, pages 15-16).
In response to Applicant’s argument (1). Examiner respectfully disagrees. Claim 1 recites a method for performing Monte Carlo simulations from multiple scenarios using a fitness function to score the simulation results and to determine modification to the I&W cutoff values of an operating system for improving simulation results in order to identify multiple recommended courses and cutoff values for generating a notification, the I&W cutoff values are updated for future simulation, and one or more recommended courses are presented in order to perform one or more recommended actions to control the operating system as described in the Applicant's disclosure in paragraph 0045 "the end result of the simulation process 300 is a data store that contains information regarding a large number of simulated scenarios. For example, the data store 306 may store information identifying the parameters 310 used for numerous simulations. The data store 306 may also store information identifying the course(s) of action that may be recommended for use as determined for each of the simulations. The data store may further store information identifying the I&W cutoff value(s) 312 that should be used to generate at least one indication or warning as determined for each of the simulations." See also claims 2-3, 5-7, 9-10, 12-14, 16-17 and 19-23. Claim 1 recites a concept related to Certain Methods of Organizing Human Activity including mitigating risk and Mental Processes such as concepts performed in the human mind including an observation (randomized parameters, I&W cutoff values, one or more characteristics associated with a current operational environment, matching simulated scenarios with one or more characteristics associated with a current operational environment, I&W cutoff values define criteria based on specific indications and warnings), evaluation (Monte Carlo simulation for multiple simulated scenarios, scoring the simulation results identifying multiple cutoff values and multiple courses of action, updating I&W cutoff values), judgment (notify using the cutoff values) and opinion (presenting I&W cutoff values define criteria based on specific indications and warnings and one or more recommended actions to be performed) Therefore, claim 1 recites an abstract idea falling within the Guidance's subject-matter grouping to the group of certain methods of organizing human activity including fundamental economic practices or practices including mitigating risk i.e., recommendation of courses of actions based on simulations and Mental Processes. The same rationale applies to claims 8 and 15. In addition, the amended claims are not similar to Example 48, claim 2 because steps (b)-(e) recite judicial exceptions, steps (f) and (g) are directed to creating a new speech signal that no longer contains extraneous speech signals from unwanted sources. The claimed invention reflects this technical improvement by including these features. Further, converting clusters into separate speech waveforms and generating a mixed speech signal from the separate speech waveforms are not insignificant extra-solution activity, mere instructions to apply the exception, or mere field of use limitations. Rather, these steps reflect the improvement described in the disclosure. The instant claims do not recite a technical improvement to the field of databases. Per Prong Two of Step 2A, this judicial exception is not integrated into a practical application because the claim as a whole does not integrate the identified abstract idea into a practical application. The processing device, simulation database and operating system is recited at a high level of generality, i.e., as a generic processor performing a generic computer function of receiving/determining/transmitting data. This generic processor limitation is no more than mere instructions to apply the exception using a generic computer component. The simulation database as explained above is a generic simulation database limitation is no more than mere instructions to apply the exception using a generic database component as shown in Applicant’s disclosure paragraph 0030. The operating system as explained above is a generic operating system limitation is no more than mere instructions to apply the exception using a generic specified system as shown in Applicant’s disclosure paragraph 0018 in a space environment. The heuristic deployment network is used as a tool, (see Applicant’s disclosure paragraph 0040) in its ordinary capacity, to carry out the abstract idea i.e., Monte Carlo simulations or other simulations to generate simulation results. Considering the claims as a whole, these additional limitations merely add generic computer activities i.e., receiving/determining/transmitting to receive inputs, analyze/identify recommended actions and cutoff values from the simulations, in order to notify and recommend courses of action. The recited processing device, simulation database and operating system, merely links the abstract idea to a computer environment. In this way, the processing device, simulation database and operating system involvement is merely a field of use which only contributes nominally and insignificantly to the recited method, which indicates absence of integration. Claims 1, 8 and 15 uses the processing device, simulation database and operating system as a tool, in its ordinary capacity, to carry out the abstract idea.
As to this level of computer involvement, mere automation of manual processes using generic computers does not necessarily indicate a patent-eligible improvement in computer technology. Considered as a whole, the claimed method does not improve the functioning of the computer itself or any other technology or technical field. Further, a processor configured to cause receiving/determining/transmitting data to a device is mere instruction to apply an exception using a generic computer component which cannot integrate a judicial exception into a practical application. Accordingly, this/these additional element(s) does/do not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The rejection is maintained.
With regard to the 35 U.S.C. 103, Applicant’s arguments (Remarks, pages 17-20) with respect to claim(s) 1, 8 and 15 have been considered. Please see the updated rejection below of Nanda et al., in view of Flores et al., In addition, in response to applicant's argument that the references fail to show certain features of the invention, it is noted that the features upon which applicant relies (i.e., the creation of a search result database) are not recited in the rejected claim(s). Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 5-6, 8-10, 12-13, 15-17 and 19-23 are rejected under 35 U.S.C. 103(a) as being unpatentable over Nanda et al., (US 2020/0045069A1) hereinafter “Nanda" in view of Flores et al., (US 2013/0347116 A1) hereinafter “Flores”.
Claim 1:
Nanda as shown discloses a method, the method comprising:
generating a plurality of indication and warning (I&W) cutoff values representing cutoff values that can be used in a simulation using the heuristic deployment network ¶ 0054: “the system is an active system that is responsive to detected anomaly. Thus, when an anomaly is detected, the anomaly pattern may be added to the modeler 54 in order to run a simulation so that the automated decision-maker 48 can determine what steps to take to address the anomaly. The detected anomalies via sensors 20 drive the modeler 54 and the decision engine 48 reads the outputs of the simulator to make a report. Once the report is generated, there is choice to take the top ranked action or do nothing. Alternatively, the report may be provided to the human administrator to execute the options that are provided as a result or provided from the automated decision engine.”);
Nanda describes in ¶ 0036: “CoA simulator 16 may include and may perform parallel packet level simulations 32 and predict future impacts 34” i.e., heuristic deployment network, (as per Applicant’s disclosure ¶ 0040: “use of a heuristic deployment framework 302, which represents an optimization framework that can perform various simulations and identify optimal parameters associated with the simulations.”), ¶ 0021: “a course of action (CoA) simulator coupled to the network analyzer adapted to generate a list of decision including courses of action to address the anomalies; and a training and feedback unit coupled to the CoA simulator to train the system to improve responses in addressing future anomalies.” And ¶ 0056: “ the CoA simulator 16, the system of the present disclosure may quantitatively and qualitatively evaluate different actions in an automated manner using parallel simulations to rank the suggested Course of Action options.” Nanda is silent with regard to the following limitations. However, Flores in an analogous art of threat evaluation management for the purpose of providing the following limitations as shown does:
generating a plurality of randomized parameters of an operating system using a heuristic deployment network (¶ 0075: “Monte Carlo algorithms use random samples of input parameters to investigate the behavior of complex systems.”);
performing a plurality of Monte Carlo simulations on an operating system using the heuristic deployment network to generate a plurality of simulation results responsive to the randomized parameters and the I&W cutoff values, wherein the each of the simulation results comprise various combinations of the randomized parameters of the operating system and the plurality of indication and warning (I&W) cutoff values each of the various combinations associated with a particular operating environment for the operating system (¶ 0075: “Monte Carlo algorithms use random samples of input parameters to investigate the behavior of complex systems. […] The threat evaluation engine 202 would also make additional random draws, as necessary. The threat evaluation results 204 would consist of probabilities of an outcome.” See also ¶ 0097: “The threat evaluation simulation engine 418 shown in FIG. 6 uses Monte Carlo methods to evaluate a user-specified number of trials 604. Namely, the engine will sample the probability distributions to produce a representative set of all of the possible outcomes of the modeled system.”);
storing the simulation results in a simulation database for each of the plurality of Monte Carlo simulations (¶ 0102: “The results of the ingress and egress access point evaluations are then stored 620 into the datastore 204. If the last attack scenario for the particular Monte Carlo simulation is reached 622, then the engine begins the next simulation evaluation. If the last Monte Carlo simulation has been achieved 624, then the threat evaluation simulation for the given path and opponent is complete 626.
scoring the simulation results using a fitness function configured within heuristic deployment network (¶ 0077: “Evolutionary algorithms use a population-based heuristic optimization that mimics a process of natural selection. These algorithms require the definition of a fitness function that determines the conditions under which the populations exists. In general, this fitness function could seek to optimize a solution towards any desired set of conditions.” See also ¶ 0082: “Monte Carlo methods are especially well suited for these types of situations where no obvious deterministic solution exists. They are able to sample all possible outcomes of the input probability distributions. Indeed, the use of probability distributions as input produces distribution functions as outputs from the simulation. Thus, the results contain a range of possible outcomes including the best, average, and worst case scenarios.”);
determining modifications for the I&W cutoff values responsive to the scoring of the simulation results to improve the simulation results (¶ 0109: “an analysis of the impact caused by changing certain features in the network model datastore 112 can be performed (see FIG. 1). A “what-if” analysis, as it is often called, could answer the question of how scenarios implemented as deviations from a baseline network-model might affect security.”);
updating the I&W cutoff values according to the determined modifications to improve the simulation results (¶ 0109: “A report for this analysis could display the areas in the model that have shown significant improvement or degradation in the ability of an opponent to reach the target. In particular, this report could show the changes to traversal success for an opponent sorted from greatest improvement to greatest degradation. The report might also display the changes in probability of successful traversal graphically so that the analyst could quickly determine the impact of the network changes”);
Both Nanda and Flores teach threat evaluation management. Nanda teaches in ¶ 0048: “may run or execute a number of simulations in parallel that provide multiple outcomes to make a prediction from the CoA simulator 16 of what the network 80 behavior will be at a point later in time if an action is taken (such as blocking a threat to the network, or shaping network traffic)” Flores teaches in the Abstract “evaluation of threats to elements of a client computer application having a cyber reference library, an opponent catalog and a network model.” Thus, they are deemed to be analogous references as they are reasonably pertinent to each other and are directed towards solving similar problems within the same environment. One of ordinary skill in the art would have recognized that applying the known technique of Flores would have yielded predictable results and resulted in an improved system. It would have been recognized that applying the technique of Flores to the teaching of Nanda would have yielded predictable results because the level of ordinary skill in the art demonstrated by the references applied shows the ability to incorporate such as generating a plurality of randomized parameters of an operating system using a heuristic deployment network generating a plurality of indication and warning (I&W) cutoff values representing cutoff values that can be used in a simulation using the heuristic deployment network performing a plurality of Monte Carlo simulations on an operating system using the heuristic deployment network to generate a plurality of simulation results responsive to the randomized parameters and the I&W cutoff values, wherein the each of the simulation results comprise various combinations of the randomized parameters of the operating system and the plurality of indication and warning (I&W) cutoff values each of the various combinations associated with a particular operating environment for the operating system; storing the simulation results in a simulation database for each of the plurality of Monte Carlo simulations scoring the simulation results using a fitness function configured within heuristic deployment network determining modifications for the I&W cutoff values responsive to the scoring of the simulation results to improve the simulation results: updating the I&W cutoff values according to the determined modifications to improve the simulation results into similar systems. Further, as noted by Flores “Monte Carlo algorithms use random samples of input parameters to investigate the behavior of complex systems” (Flores, ¶ 0075).
In addition, Nanda teaches:
identifying one or more characteristics (¶ 0034: “Sensor alert ingestion framework 12 may include anomaly sensors 20.” See also ¶ 0016: “determine which decisions to take when receiving a large volume of anomalies from individual network based sensors.”) associated with a current operational environment of the operating system (¶ 0021: “a sensor alert ingestion framework adapted to monitor network activity." See also Figure 1, ADMIN system 10 and ¶ 0047: “the present disclosure provides methods of operations for an autonomic system for network defense.”);
identifying one or more simulation results having one or more characteristics that are similar to or match the one or more characteristics associated with the current operational environment (¶ 0036: ”CoA simulator 16 may include and may perform parallel packet level simulations 32 and predict future impacts 34.” See also figure 2 and ¶ 0054: “when an anomaly is detected, the anomaly pattern may be added to the modeler 54 in order to run a simulation so that the automated decision-maker 48 can determine what steps to take to address the anomaly. The detected anomalies via sensors 20 drive the modeler 54 and the decision engine 48 reads the outputs of the simulator to make a report.”);
identifying, from among the plurality of I&W cutoff values, one or more I&W cutoff values associated with the one or more simulation results having the one or more characteristics that are similar to or match the one or more characteristics associated with the current operational environment; identifying, from among multiple recommended courses of action, one or more recommended courses of action associated with the one or more simulation results having the one or more characteristics that are similar to or match the one or more characteristics associated with the current operational environment (¶ 0040: “The Simulator 16 performs the decide function 68.” ¶ 0048: “The system 10 of the present disclosure may run or execute a number of simulations in parallel that provide multiple outcomes to make a prediction from the CoA simulator 16 of what the network 80 behavior will be at a point later in time if an action is taken (such as blocking a threat to the network, or shaping network traffic). Then, using the feedback of whether that action actually happens to train the system while it is working to determine whether the system is performing optimally to make correct predictions. Thus, in one particular embodiment, the system may generally be considered a feedback control system combined with a simulator with an anomaly detector.”, see also ¶ 0094 which describe severity of suspected adversarial behavior and ¶ 0095: “The CoA simulator 16 may use templates for building new facts. Each incoming alert may be transformed into a fact and these facts may trigger rules. When a rule is triggered, a specified action occurs. For example, when the number of alerts with the same node or anomaly ID reaches a specified threshold, CLIPS will look up its predefined rules to suggest one or more corrective action based on information about the state of the network and other facts.” See Table 1);
using the one or more I&W cutoff values to generate at least one notification to the heuristic deployment network, the at least one notification associated with the current operational environment of the operating system; (¶ 0036: “CoA simulator 16 sends one or more ranked list of actions to an operator or sends instructions to execute the ranked list of actions downstream along link 36 to the training and experimental feedback 18.”);
dynamically updating the I&W cutoff values based on the one or more recommended courses of action to be performed to enable response to a new scenario in a future simulation (¶ 0102: “online training via Q-Learning, the training and feedback unit 18 may implements (the Act step 70) an automated online reinforcement algorithm or process to enable ADMIN system 1 to adjust itself and improve its decisions over time, in a supervised or unsupervised manner. The ADMIN system 10 approach to online training via Q-learning 38 is to apply offline training to build the initial rules for the CoA and apply Q-Learning (a model-free reinforcement AI technique) to update rules based on experience gained by making exploratory decisions.” See also ¶ 0016: “autonomically executing the at least one course of action; and adjusting future executions of courses of action based, at least in part, on training and updating rules via experience gained by making exploratory decisions and execution exploratory course of actions.”);
presenting the one or more recommended courses of action to the heuristic deployment network for initiation by the heuristic deployment network e within the operating system; (¶ 0021: “ to monitor network activity and alert detected or suspected anomalies; a network analyzer coupled to the sensor alert ingestion framework adapted to analyze the anomalies; a course of action (CoA) simulator coupled to the network analyzer adapted to generate a list of decision including courses of action to address the anomalies; and a training and feedback unit coupled to the CoA simulator to train the system to improve responses in addressing future anomalies.” See also ¶ 0095: The output of the traffic modeler 54 may be the candidate list of recommended corrective actions that are fed into the network simulator 48 for impact evaluation.” ¶ 0014: “applies advances in machine learning with simulation-based risk assessment to address these challenges. The solution assists operators execute corrective actions quickly and with high accuracy. Additionally provided is a fully autonomic network defense system that can be trusted to operate independently and learn from operational experiences.” See also ¶ 0068);
and performing, by the heuristic deployment network, at least one of the one or more recommended courses of action to control the operating system (¶ 0068: “For fully autonomic defense, ADMIN system 10 has administrative control and may be empowered to apply a broad set of corrective actions autonomously.” See also ¶ 0105-0106: “Q-Learning is a model-free reinforcement-based machine learning and artificial intelligence (AI) algorithm that has shown success in several classes of autonomic exploratory decision problems (e.g., controlling robots in a new environment) that rely on environmental feedback. In fully autonomic mode, ADMIN system 10 ranks its own decisions and immediately applies the corrective actions on the network 80.” See also ¶ 0090);
Claims 8 and 15:
The limitations of claims 8 and 15 (¶ 0124: “the instructions or software code can be stored in at least one non-transitory computer readable storage medium”) encompass substantially the same scope as claim 1. Accordingly, those similar limitations are rejected in substantially the same manner as claim 1, as described above. The following limitations differs from claim 1:
Claim 8:
Nanda as shown discloses an apparatus, the apparatus comprising:
at least one processing device configure to (¶ 0124: “any suitable processor or collection of processors”);
Claim 2:
Nanda as shown discloses the following limitations:
wherein the one or more recommended courses of action are presented in response to determining that at least one of the one or more I&W cutoff values has triggered the at least one notification to the heuristic deployment network e (¶ 0095: “The CoA simulator 16 may use templates for building new facts. Each incoming alert may be transformed into a fact and these facts may trigger rules. When a rule is triggered, a specified action occurs. For example, when the number of alerts with the same node or anomaly ID reaches a specified threshold, CLIPS will look up its predefined rules to suggest one or more corrective action based on information about the state of the network and other facts. The output of the traffic modeler 54 may be the candidate list of recommended corrective actions that are fed into the network simulator 48 for impact evaluation.” See also Table 1);
Claims 9 and 16:
The limitations of claims 9 and 16 encompass substantially the same scope as claim 2. Accordingly, those similar limitations are rejected in substantially the same manner as claim 2, as described above.
Claim 3:
Nanda as shown discloses the following limitations:
further comprising: dynamically updating at least one of the one or more I&W cutoff values or at least one of the one or more recommended courses of action based on one or more updated characteristics associated with the current operational environment (¶ 0102: “online training via Q-Learning, the training and feedback unit 18 may implements (the Act step 70) an automated online reinforcement algorithm or process to enable ADMIN system 1 to adjust itself and improve its decisions over time, in a supervised or unsupervised manner. The ADMIN system 10 approach to online training via Q-learning 38 is to apply offline training to build the initial rules for the CoA and apply Q-Learning (a model-free reinforcement AI technique) to update rules based on experience gained by making exploratory decisions.” See also ¶ 0016: “autonomically executing the at least one course of action; and adjusting future executions of courses of action based, at least in part, on training and updating rules via experience gained by making exploratory decisions and execution exploratory course of actions.”);
Claims 10 and 17:
The limitations of claims 10 and 17 encompass substantially the same scope as claim 3. Accordingly, those similar limitations are rejected in substantially the same manner as claim 3, as described above.
Claim 5:
Nanda as shown discloses the following limitations:
obtaining parameters defining each of the simulation results; simulating use of different courses of action for each of the simulation results s using different selected I&W cutoff values to generate different simulation results for each simulated scenario; and scoring the simulation results to identify one or more optimal courses of action and one or more optimal I&W cutoff values for each of the simulation results (¶ 0100-0101: “By running multiple simulations in parallel, based on prior experiences, the network simulator 48 can return its ranked list of CoA decisions (i.e., decision list 90) in one minute or less, with a look-ahead horizon of at least 10 minutes. The parameters for ranking the decision list 90 may vary depending on the desired outcomes of the operator of network 80.[…] The final output of the network simulator 48 and thus the entire CoA Simulator is the ranked list of recommended corrective actions (i.e., the decision list 90) that are provided to the network operator for manual review in ADMIN's semi-autonomic mode, or directly executed on the network in fully-autonomic mode.” See also ¶ 0043: “CoA simulator 16 may output ranked decisions and provide a prediction of expected changes in future performance” and ¶ 0054 and 0087 );
Claims 12 and 19:
The limitations of claims 12 and 19 encompass substantially the same scope as claim 5. Accordingly, those similar limitations are rejected in substantially the same manner as claim 5, as described above.
Claim 6:
Nanda as shown discloses the following limitations:
modifying the selected I&W cutoff values based on the scoring to produce updated I&W cutoff values; and simulating use of the different courses of action for each of the simulation results using the updated I&W cutoff values (¶ 0102: “online training via Q-Learning, the training and feedback unit 18 may implements (the Act step 70) an automated online reinforcement algorithm or process to enable ADMIN system 1 to adjust itself and improve its decisions over time, in a supervised or unsupervised manner. The ADMIN s