Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendments / Arguments
Regarding the rejection(s) of claims under 35 USC 103:
Applicant’s arguments, filed 08/14/2026, in view of the amended claims, have been fully considered and are not persuasive.
Applicant first argues that "Rieke does not disclose 'determining whether values of the invariance identifying property associated with each of the plurality of resources in the resource group satisfy a second equivalence rule'" because "Rieke, instead, evaluates individual events, not properties across an entire group of static resources." In response, Rieke at paragraph [0136] expressly discloses that the evaluator "Detected Ports[]=Asset Ports[]" "is populated at instantiation time for all assets based on the values of the Asset Ports attribute for each asset in the baseline," and further that an alternate embodiment presents the operator "with a visualization or list of the existing Asset Port values for review and modification prior to instantiating the baseline." Paragraph [0157] confirms that "attribute values for detected port attributes of each of the selected relationships are based on values for asset port attributes of the selected assets when the respective selected relationship is instantiated." The Asset Ports attribute is a stored asset attribute ([0051], [0134]), not an event; accordingly, Rieke discloses processing a property across each member of a group of static resources selected by "Group=TrustZone1" ([0134]), which teaches the claimed limitation. Paragraph [0135] further discloses selection across a set of candidate properties, i.e., selecting "all relationships that have the attribute 'Detected Ports'."
Secondly, Applicant argues that "In Rieke, the baseline relationship is pre-existing" and that Rieke "inherently cannot disclose generating the baseline itself in response to a successful determination across a resource group." In response, Rieke defines a baseline as "a combination of one or more assets and one or more relationships evaluated against one or more sets of events" ([0054]), and recites "the creation of relationships (2435), the selection of relationships (2440), the creation of baselines (2445)" as distinct steps ([0097], FIG. 24). Paragraph [0143] states that "the creating the baseline comprises selecting assets based on attribute values, and selecting relationships based on attribute values." What pre-exists in Rieke is the library of relationships ([0128]); the baseline is generated, and paragraph [0136] places the determination of asset attribute values expressly "prior to instantiating the baseline." Rieke further states at paragraphs [0010] and [0096] that "over time, these baselines and analyses can be automatically created through observation of the operational event streams," which is contrary to Applicant's assertion that Rieke is incapable of disclosing baseline generation.
Finally, Applicant argues that the rationale to combine constitutes impermissible hindsight because "Rieke's attribute evaluation is utilized exclusively for detecting anomalies in incoming network events against an already established baseline." In response to applicant's arguments against the references individually, one cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. Allen was relied upon for cloud resource grouping, and Rieke for attribute evaluation over selected assets. Further, the premise that Rieke's evaluation is used "exclusively" post-baseline is not supported, as set forth above. The rationale to combine is drawn from Rieke itself, which states that conventional systems "have limited or no ability to produce information indicating normal operations or deviations from normal" and that "[s]uch challenges can be particularly difficult in distributed computing, virtualized computing systems, or 'cloud computing' systems" ([0043]). A motivation supplied by the prior art's own statement of the problem is not hindsight.
Therefore, the identified claim language is considered to be taught by the combination, and the rejection is maintained. Further, since Applicant has not argued the dependent claims, their rejections are likewise maintained.
DETAILED ACTION
This is a reply to the arguments filed on 08/14/2026, in which, claims 1-6, 8, and 10-21 are pending. Claims 1, 11, and 19 are independent. Claim 7 and 9 has been canceled.
When making claim amendments, the applicant is encouraged to consider the references in their entireties, including those portions that have not been cited by the examiner and their equivalents as they may most broadly and appropriately apply to any particular anticipated claim amendments.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-6, 8 and 10-21 are rejected under 35 U.S.C. 103 as being unpatentable over Allen et al. (US 20170078315 A1, referred to as Allen), in view of Rieke (US 20180248901 A1, referred to as Rieke) in further view of Ahad et al. (US 20190042353 A1, referred to as Ahad).
In reference to claim 1, A method comprising: generating a resource group including a plurality of resources of a environment based on a grouping property, wherein values of the grouping property associated with the plurality of resources satisfy a first condition (Allen: [0006] provides for defining assets as entities capable of generating or receiving information, which encompasses resources in a monitored environment. Allen paragraph [0032] further provides for a security system that generates cluster maps in which it groups together similar assets based on having similar state and event information. Allen paragraph [0087] even further provides that assets are grouped together into a cluster when their state and event information values are sufficiently similar to each other.) Incorporating a value in a baseline (Allen: paragraph [0088] provides for establishing baseline values for attributes of devices within a cluster. Allen paragraphs [0032] and [0087] (mentioned above) provides that the attributes used to group devices into a cluster include state information and event information. The baseline values are defined based on the normal/expected values of that same state and event information for the clustered devices.) Performing, by an anomaly detector, anomaly detection of the environment using the baseline, wherein the anomaly detector modifies a configuration of the environment upon detection of an anomaly (Allen: paragraph [0041] provides for using the baseline activities to detect when a user performs an action that is not included in the baseline, such as accessing a database at an unusual time. Allen paragraph [0104] provides for automated responses to detected anomalies.)
Allen does not explicitly disclose that the incorporating step is a response of a successful determination of whether values of the invariance identifying property associated with the plurality of resources in the resource group satisfy a second condition and that the value being incorporated into the baseline is a invariant defined by a tuple including, the grouping property and the invariance identifying property. Allen further does not explicitly disclose that anomaly detection is done in a cloud environment. However, Rieke discloses: Iteratively processing, each invariance identifying property in a set of invariance identifying properties, determining whether values of the invariance identifying property associated with each of the plurality of resources in the resource group satisfies a second equivalence rule, generating a baseline for the cloud environment, the baseline including an invariant (Rieke: paragraph [0107] provides for that relationships derived from asset attributes are evaluated by the system, which can involve determining certain values associated with the attributes. Rieke paragraph [0108] further provides that the evaluation of attributes involves evaluators that process the attribute values, which can be considered conditions that the values must satisfy. Rieke [0115]-[0116] further provide iterative processing of multiple invariance identifying properties (attributes) for each resource (asset/event) in the system. Rieke paragraph [0126] provides for evaluation of multiple properties per resource. Rieke: [0051], [0134]-[0136], [0157] Provides for processing a stored asset attribute across each resource of a group selected by the grouping property in that the evaluator is populated at instantiation time for all assets based on the Asset Ports attribute value of each asset in the baseline. Further provides for processing across a set of candidate properties, in that the operator selects all relationships having the attribute "Detected Ports" for any value of that attribute.)
successfully determinate that each resource included in the plurality of resources in the resource group satisfies the second equivalence rule (Rieke: [0122] provides successful determination that resources satisfy evaluation criteria before proceeding with baseline operations. The baseline creation process inherently requires confirming compliance across all selected assets before establishing the baseline for anomaly detection, as described in paragraphs [0139] and [0054] where baselines are created as a combination of one or more assets and one or more relationships evaluated against one or more sets of events. Rieke: [0010], [0054], [0096]-[0097], [0128], [0136], [0143] Provides for the baseline being generated as a distinct step separate from the relationships it selects, such that the determination of asset attribute values occurs "prior to instantiating the baseline" and thereby precedes and gates baseline generation. Further provides that such baselines can be automatically created through observation over time.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Allen, which provides a method for grouping resources based on similar attributes and using baselines for anomaly detection, with the teachings of Rieke, which introduces the concept of evaluating multiple invariance identifying properties against specific conditions. One of ordinary skill in the art would recognize the ability to incorporate Rieke's attribute evaluation into Allen's resource grouping and baseline creation process to enhance the accuracy of resource categorization. One of ordinary skill in the art would be motivated to make this modification in order to create more precise resource groups, leading to more accurate baselines. Allen in view of Rieke does not explicitly disclose that the value being incorporated into the baseline is a invariant defined by a tuple including, the grouping property and the invariance identifying property. Allen in view of Rieke further does not explicitly disclose that anomaly detection is done in a cloud environment. However, Ahad discloses: Wherein the value is a invariant is defined by a tuple including, (i) the grouping property and the first equivalence rule associated with the grouping property, (Ahad: [0010]-[0011], [0094]-[0097], [0132]-[0135] and [0119] Provides for using tuples to define baseline behavior (normal operating conditions) for the system as well as component types and assemblies that define how resources are grouped.)
(ii) the invariance identifying property and the second equivalence rule associated with the invariance identifying property, wherein at least the second equivalence rule corresponds to the values of the invariance identifying property associated with the plurality of resources in the resource group being equivalent (Ahad: [0132]-[0136] Provides for defining metrics and their associated bounds (minimum/maximum values, soft limits) which teaches to identifying properties. Further provides what makes values "equivalent" (normal) by specifying ranges that constitute normal operation. Values that fall within the defined range are considered equivalent (all normal), while those outside the range are anomalous.)
Performing anomaly detection using a baseline in a cloud environment (Ahad: [0013], [0077]-[0083], [0119]-[0123] Provides for anomaly detector (ADRC) that uses defined baselines to detect anomalies in the cloud environment.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Allen in view of Rieke, which provides a method for grouping resources based on multiple attributes and evaluating them against specific conditions, with the teachings of Ahad, which introduces defining invariants as tuples of properties and rules and applying anomaly detection in cloud environments. One of ordinary skill in the art would recognize the ability to incorporate Ahad's tuple-based invariant definition and cloud-focused anomaly detection into the combined system to enhance its applicability and precision in modern computing environments. One of ordinary skill in the art would be motivated to make this modification in order to create a more robust anomaly detection system capable of formally defining normal behavior using comprehensive tuples.
In reference to claim 2, the method of claim 1, further comprising: identifying the first equivalence rule associated with the grouping property, (Allen: paragraph [0032] provides for grouping assets based on shared state and event information, which teaches the use of a first equivalence rule for determining similarity of the grouping property.)
Allen does not explicitly disclose the use of a second equivalence rule, however Rieke teaches:
the second equivalence rule associated with a invariance identifying property, wherein the grouping property is different than the first invariance identifying property(Rieke: paragraph [0107] provides for the evaluation of relationships based on attributes derived from assets or events, which teaches the use of a second equivalence rule for determining similarity of the invariance identifying property.)
In reference to claim 3, the method of claim 2, wherein rule, the first equivalence rule corresponds to the values of the grouping property associated with the plurality of resources being in a first predetermined range of values associated with the grouping property, (Allen: paragraph [0032] provides for grouping assets based on shared state and event information (values of the grouping property satisfying the first equivalence rule). Allen paragraphs [0081] and [0109] further provides for normalizing attribute values within a predetermined range, which teaches the claim's description of an equivalence rule involving a predetermined range of values.)
In reference to claim 4, The method of claim 1, wherein the first equivalence rule corresponds to the values of the grouping property associated with the plurality of resources being identical, (Rieke: paragraph [0108] provides for that relationships can be defined by identical attributes (first equivalence rule corresponds to values being identical.))
In reference to claim 5, the second equivalence rule corresponds to the values of the first invariance identifying property associated with the plurality of resources in the resource group being in a second predetermined range of values associated with the first invariance identifying property, (Allen: paragraphs [0081] and [0109] provides for normalizing attribute values within a predetermined range, which teaches the claim's description of an equivalence rule involving a predetermined range of values (second equivalence rule corresponding to values being in a second predetermined range.))
In reference to claim 6, the method of claim 2, wherein the second equivalence rule corresponds to the values of the first invariance identifying property associated with the plurality of resources in the resource group being identical, (Rieke: paragraph [0108] provides for relationships can be defined by identical attributes (second equivalence rule corresponds to values being identical.))
In reference to claim 8, incorporating a second invariant in the baseline, wherein the second invariant is defined by the grouping property and the second invariance identifying property, (Allen: paragraph [0088] provides for establishing multiple baseline values (first invariant, second invariant, etc.) for attributes of devices within a cluster (resource group), where the attributes include the state and event information used for grouping (grouping property) and defining normal/expected behavior (first invariance identifying property, second invariance identifying property, etc.))
Allen does not explicitly disclose selecting a second invariance identifying property from the set of invariance identifying properties, determining whether values of the second invariance identifying property associated with the plurality of resources satisfy a third condition and a response to a successful determination of whether values of the second invariance identifying property associated with the plurality of resources satisfy a third condition, however, Rieke teaches:
The method of claim 1, further comprising: selecting a second invariance identifying property from the set of invariance identifying properties, (Rieke paragraph [0008] provides for the process of selecting specific attributes from an asset attribute database.)
Determining whether values of the second invariance identifying property associated with the plurality of resources in the resource group satisfy a third equivalence rule, (Rieke: paragraph [0107] provides for the evaluation of relationships based on attributes derived from assets or events.)
Rieke also discloses a response to a successful determination of whether values of the second invariance identifying property associated with the plurality of resources satisfy a third condition (Rieke: paragraph [0097] provides for details how after successful creation of relationships that are selected and used in a baseline.)
In reference to claim 10, The method of claim 1, further comprising: detecting a trigger signal to initiate anomaly detection of the cloud environment; performing anomaly detection of the cloud environment in response to detecting the trigger signal, (Allen: paragraph [0041] provides for specific actions triggering the use of the anomaly detection system.) Generating an alert signal responsive to detecting an anomaly in the cloud environment, (Allen paragraph [0014] provides for the one or more actions could be an alert.)
In reference to claim 11, A computing device comprising: a processor; and a memory including instructions that, when executed with the processor, cause the computing device to, at least: generate a resource group including a plurality of resources of a environment based on a grouping property, wherein values of the grouping property associated with the plurality of resources satisfy a first equivalence rule (Allen: [0006] provides for defining assets as entities capable of generating or receiving information, which encompasses resources in a monitored environment. Allen paragraph [0032] further provides for a security system that generates cluster maps in which it groups together similar assets based on having similar state and event information. Allen paragraph [0087] even further provides that assets are grouped together into a cluster when their state and event information values are sufficiently similar to each other.) Incorporate a value in a baseline (Allen: paragraph [0088] provides for establishing baseline values for attributes of devices within a cluster. Allen paragraphs [0032] and [0087] (mentioned above) provides that the attributes used to group devices into a cluster include state information and event information. The baseline values are defined based on the normal/expected values of that same state and event information for the clustered devices.) Perform, by an anomaly detector, anomaly detection of the environment using the baseline, wherein the anomaly detector modifies a configuration of the environment upon detection of an anomaly (Allen: paragraph [0041] provides for using the baseline activities to detect when a user performs an action that is not included in the baseline, such as accessing a database at an unusual time. Allen paragraph [0104] provides for automated responses to detected anomalies.)
Allen does not explicitly disclose that the incorporating step is a response of a successful determination of whether values of the invariance identifying property associated with the plurality of resources in the resource group satisfy a second condition and that the value being incorporated into the baseline is a invariant defined by a tuple including, the grouping property and the invariance identifying property. Allen further does not explicitly disclose that anomaly detection is done in a cloud environment. However, Rieke discloses: Iteratively processing, each invariance identifying property in a set of invariance identifying properties, determining whether values of the invariance identifying property associated with each of the plurality of resources in the resource group satisfies a second equivalence rule, generating a baseline for the cloud environment, the baseline including an invariant (Rieke: paragraph [0107] provides for that relationships derived from asset attributes are evaluated by the system, which can involve determining certain values associated with the attributes. Rieke paragraph [0108] further provides that the evaluation of attributes involves evaluators that process the attribute values, which can be considered conditions that the values must satisfy. Rieke [0115]-[0116] further provide iterative processing of multiple invariance identifying properties (attributes) for each resource (asset/event) in the system. Rieke paragraph [0126] provides for evaluation of multiple properties per resource. Rieke: [0051], [0134]-[0136], [0157] Provides for processing a stored asset attribute across each resource of a group selected by the grouping property in that the evaluator is populated at instantiation time for all assets based on the Asset Ports attribute value of each asset in the baseline. Further provides for processing across a set of candidate properties, in that the operator selects all relationships having the attribute "Detected Ports" for any value of that attribute.)
successfully determinate that each resource included in the plurality of resources in the resource group satisfies the second equivalence rule (Rieke: [0122] provides successful determination that resources satisfy evaluation criteria before proceeding with baseline operations. The baseline creation process inherently requires confirming compliance across all selected assets before establishing the baseline for anomaly detection, as described in paragraphs [0139] and [0054] where baselines are created as a combination of one or more assets and one or more relationships evaluated against one or more sets of events. Rieke: [0010], [0054], [0096]-[0097], [0128], [0136], [0143] Provides for the baseline being generated as a distinct step separate from the relationships it selects, such that the determination of asset attribute values occurs "prior to instantiating the baseline" and thereby precedes and gates baseline generation. Further provides that such baselines can be automatically created through observation over time.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Allen, which provides a method for grouping resources based on similar attributes and using baselines for anomaly detection, with the teachings of Rieke, which introduces the concept of evaluating multiple invariance identifying properties against specific conditions. One of ordinary skill in the art would recognize the ability to incorporate Rieke's attribute evaluation into Allen's resource grouping and baseline creation process to enhance the accuracy of resource categorization. One of ordinary skill in the art would be motivated to make this modification in order to create more precise resource groups, leading to more accurate baselines. Allen in view of Rieke does not explicitly disclose that the value being incorporated into the baseline is a invariant defined by a tuple including, the grouping property and the invariance identifying property. Allen in view of Rieke further does not explicitly disclose that anomaly detection is done in a cloud environment. However, Ahad discloses: Wherein the value is a invariant is defined by a tuple including, (i) the grouping property and the first equivalence rule associated with the grouping property, (Ahad: [0010]-[0011], [0094]-[0097], [0132]-[0135] and [0119] Provides for using tuples to define baseline behavior (normal operating conditions) for the system as well as component types and assemblies that define how resources are grouped.)
(ii) the invariance identifying property and the second equivalence rule associated with the invariance identifying property, wherein at least the second equivalence rule corresponds to the values of the invariance identifying property associated with the plurality of resources in the resource group being equivalent (Ahad: [0132]-[0136] Provides for defining metrics and their associated bounds (minimum/maximum values, soft limits) which teaches to identifying properties. Further provides what makes values "equivalent" (normal) by specifying ranges that constitute normal operation. Values that fall within the defined range are considered equivalent (all normal), while those outside the range are anomalous.)
Performing anomaly detection using a baseline in a cloud environment (Ahad: [0013], [0077]-[0083], [0119]-[0123] Provides for anomaly detector (ADRC) that uses defined baselines to detect anomalies in the cloud environment.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Allen in view of Rieke, which provides a method for grouping resources based on multiple attributes and evaluating them against specific conditions, with the teachings of Ahad, which introduces defining invariants as tuples of properties and rules and applying anomaly detection in cloud environments. One of ordinary skill in the art would recognize the ability to incorporate Ahad's tuple-based invariant definition and cloud-focused anomaly detection into the combined system to enhance its applicability and precision in modern computing environments. One of ordinary skill in the art would be motivated to make this modification in order to create a more robust anomaly detection system capable of formally defining normal behavior using comprehensive tuples.
In reference to claim 12, the computing device of claim 11, further comprising: identifying the first equivalence rule associated with the grouping property, (Allen: paragraph [0032] provides for grouping assets based on shared state and event information, which teaches the use of a first equivalence rule for determining similarity of the grouping property.)
Allen does not explicitly disclose the use of a second equivalence rule, however Rieke teaches:
A second equivalence rule associated with a invariance identifying property wherein the grouping property is different than the first invariance identifying property (Rieke: paragraph [0107] provides for the evaluation of relationships based on attributes derived from assets or events, which teaches the use of a second equivalence rule for determining similarity of the invariance identifying property.)
In reference to claim 13, the computing device of claim 12, wherein, the first equivalence rule corresponds to the values of the grouping property associated with the plurality of resources being in a first predetermined range of values associated with the grouping property, (Allen: paragraph [0032] provides for grouping assets based on shared state and event information (values of the grouping property satisfying the first equivalence rule). Allen paragraphs [0081] and [0109] further provides for normalizing attribute values within a predetermined range, which teaches the claim's description of an equivalence rule involving a predetermined range of values.)
In reference to claim 14, the computing device of claim 11, wherein the first equivalence rule corresponds to the values of the grouping property associated with the plurality of resources being identical, (Rieke: paragraph [0108] provides for that relationships can be defined by identical attributes (first equivalence rule corresponds to values being identical.))
In reference to claim 15, the second equivalence rule corresponding to the values of the first invariance identifying property associated with the plurality of resources in the resource group being in a second predetermined range of values associated with the first invariance identifying property, (Allen: paragraphs [0081] and [0109] provides for normalizing attribute values within a predetermined range, which teaches the claim's description of an equivalence rule involving a predetermined range of values (second equivalence rule corresponding to values being in a second predetermined range.))
In reference to claim 16, the computing device of claim 12, wherein the second equivalence rule corresponds to the values of the first invariance identifying property associated with the plurality of resources in the resource group being identical, (Rieke: paragraph [0108] provides for relationships can be defined by identical attributes (second equivalence rule corresponds to values being identical.))
In reference to claim 17, incorporating a second invariant in the baseline, wherein the second invariant is defined by the grouping property and the second invariance identifying property, (Allen: paragraph [0088] provides for establishing multiple baseline values (first invariant, second invariant, etc.) for attributes of devices within a cluster (resource group), where the attributes include the state and event information used for grouping (grouping property) and defining normal/expected behavior (first invariance identifying property, second invariance identifying property, etc.))
Allen does not explicitly disclose selecting a second invariance identifying property from the set of invariance identifying properties, determining whether values of the second invariance identifying property associated with the plurality of resources satisfy a third condition and a response to a successful determination of whether values of the second invariance identifying property associated with the plurality of resources satisfy a third condition, however, Rieke teaches:
the computing device of claim 11, further comprising: selecting a second invariance identifying property from the set of invariance identifying properties, (Rieke paragraph [0008] provides for the process of selecting specific attributes from an asset attribute database.)
Determining whether values of the second invariance identifying property associated with the plurality of resources in the resource group satisfy a third equivalence rule, (Rieke: paragraph [0107] provides for the evaluation of relationships based on attributes derived from assets or events.)
Rieke also discloses a response to a successful determination of whether values of the second invariance identifying property associated with the plurality of resources satisfy a third condition (Rieke: paragraph [0097] provides for details how after successful creation of relationships that are selected and used in a baseline.)
In reference to claim 18, the computing device of claim 11, further comprising: detecting a trigger signal to initiate anomaly detection of the cloud environment; performing anomaly detection of the cloud environment in response to detecting the trigger signal, (Allen: paragraph [0041] provides for specific actions triggering the use of the anomaly detection system.) Generating an alert signal responsive to detecting an anomaly in the cloud environment, (Allen paragraph [0014] provides for the one or more actions could be an alert.)
In reference to claim 19, A non-transitory computer readable medium storing specific computer-executable instructions that, when executed by a processor, cause a computer system to perform operations comprising: identifying a set of resources in a cloud environment to be monitored generate a resource group including a plurality of resources of a environment based on a grouping property, wherein values of the grouping property associated with the plurality of resources satisfy a first equivalence rule (Allen: [0006] provides for defining assets as entities capable of generating or receiving information, which encompasses resources in a monitored environment. Allen paragraph [0032] further provides for a security system that generates cluster maps in which it groups together similar assets based on having similar state and event information. Allen paragraph [0087] even further provides that assets are grouped together into a cluster when their state and event information values are sufficiently similar to each other.) Incorporate a value in a baseline (Allen: paragraph [0088] provides for establishing baseline values for attributes of devices within a cluster. Allen paragraphs [0032] and [0087] (mentioned above) provides that the attributes used to group devices into a cluster include state information and event information. The baseline values are defined based on the normal/expected values of that same state and event information for the clustered devices.) Perform, by an anomaly detector, anomaly detection of the environment using the baseline, wherein the anomaly detector modifies a configuration of the environment upon detection of an anomaly (Allen: paragraph [0041] provides for using the baseline activities to detect when a user performs an action that is not included in the baseline, such as accessing a database at an unusual time. Allen paragraph [0104] provides for automated responses to detected anomalies.)
Allen does not explicitly disclose that the incorporating step is a response of a successful determination of whether values of the invariance identifying property associated with the plurality of resources in the resource group satisfy a second condition and that the value being incorporated into the baseline is a invariant defined by a tuple including, the grouping property and the invariance identifying property. Allen further does not explicitly disclose that anomaly detection is done in a cloud environment. However, Rieke discloses: Iteratively processing, each invariance identifying property in a set of invariance identifying properties, determining whether values of the invariance identifying property associated with each of the plurality of resources in the resource group satisfies a second equivalence rule, generating a baseline for the cloud environment, the baseline including an invariant (Rieke: paragraph [0107] provides for that relationships derived from asset attributes are evaluated by the system, which can involve determining certain values associated with the attributes. Rieke paragraph [0108] further provides that the evaluation of attributes involves evaluators that process the attribute values, which can be considered conditions that the values must satisfy. Rieke [0115]-[0116] further provide iterative processing of multiple invariance identifying properties (attributes) for each resource (asset/event) in the system. Rieke paragraph [0126] provides for evaluation of multiple properties per resource. Rieke: [0051], [0134]-[0136], [0157] Provides for processing a stored asset attribute across each resource of a group selected by the grouping property in that the evaluator is populated at instantiation time for all assets based on the Asset Ports attribute value of each asset in the baseline. Further provides for processing across a set of candidate properties, in that the operator selects all relationships having the attribute "Detected Ports" for any value of that attribute.)
successfully determinate that each resource included in the plurality of resources in the resource group satisfies the second equivalence rule (Rieke: [0122] provides successful determination that resources satisfy evaluation criteria before proceeding with baseline operations. The baseline creation process inherently requires confirming compliance across all selected assets before establishing the baseline for anomaly detection, as described in paragraphs [0139] and [0054] where baselines are created as a combination of one or more assets and one or more relationships evaluated against one or more sets of events. Rieke: [0010], [0054], [0096]-[0097], [0128], [0136], [0143] Provides for the baseline being generated as a distinct step separate from the relationships it selects, such that the determination of asset attribute values occurs "prior to instantiating the baseline" and thereby precedes and gates baseline generation. Further provides that such baselines can be automatically created through observation over time.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Allen, which provides a method for grouping resources based on similar attributes and using baselines for anomaly detection, with the teachings of Rieke, which introduces the concept of evaluating multiple invariance identifying properties against specific conditions. One of ordinary skill in the art would recognize the ability to incorporate Rieke's attribute evaluation into Allen's resource grouping and baseline creation process to enhance the accuracy of resource categorization. One of ordinary skill in the art would be motivated to make this modification in order to create more precise resource groups, leading to more accurate baselines. Allen in view of Rieke does not explicitly disclose that the value being incorporated into the baseline is a invariant defined by a tuple including, the grouping property and the invariance identifying property. Allen in view of Rieke further does not explicitly disclose that anomaly detection is done in a cloud environment. However, Ahad discloses: Wherein the value is a invariant is defined by a tuple including, (i) the grouping property and the first equivalence rule associated with the grouping property, (Ahad: [0010]-[0011], [0094]-[0097], [0132]-[0135] and [0119] Provides for using tuples to define baseline behavior (normal operating conditions) for the system as well as component types and assemblies that define how resources are grouped.)
(ii) the invariance identifying property and the second equivalence rule associated with the invariance identifying property, wherein at least the second equivalence rule corresponds to the values of the invariance identifying property associated with the plurality of resources in the resource group being equivalent (Ahad: [0132]-[0136] Provides for defining metrics and their associated bounds (minimum/maximum values, soft limits) which teaches to identifying properties. Further provides what makes values "equivalent" (normal) by specifying ranges that constitute normal operation. Values that fall within the defined range are considered equivalent (all normal), while those outside the range are anomalous.)
Performing anomaly detection using a baseline in a cloud environment (Ahad: [0013], [0077]-[0083], [0119]-[0123] Provides for anomaly detector (ADRC) that uses defined baselines to detect anomalies in the cloud environment.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Allen in view of Rieke, which provides a method for grouping resources based on multiple attributes and evaluating them against specific conditions, with the teachings of Ahad, which introduces defining invariants as tuples of properties and rules and applying anomaly detection in cloud environments. One of ordinary skill in the art would recognize the ability to incorporate Ahad's tuple-based invariant definition and cloud-focused anomaly detection into the combined system to enhance its applicability and precision in modern computing environments. One of ordinary skill in the art would be motivated to make this modification in order to create a more robust anomaly detection system capable of formally defining normal behavior using comprehensive tuples.
In reference to claim 20, The non-transitory computer readable medium storing specific computer-executable instructions of claim 19, further comprising: identifying the first equivalence rule associated with the grouping property, (Allen: paragraph [0032] provides for grouping assets based on shared state and event information, which teaches the use of a first equivalence rule for determining similarity of the grouping property.)
Wherein the first equivalence rule corresponds to the values of the grouping property associated with the plurality of resources being in a first predetermined range of values associated with the grouping property, (Allen: paragraph [0032] provides for grouping assets based on shared state and event information (values of the grouping property satisfying the first equivalence rule). Allen paragraphs [0081] and [0109] further provides for normalizing attribute values within a predetermined range, which teaches the claim's description of an equivalence rule involving a predetermined range of values (first equivalence rule corresponding to values being in a first predetermined range.))
Allen does not explicitly disclose the use of a second equivalence rule, however Rieke teaches:
a second equivalence rule associated with a first invariance identifying property, (Rieke: paragraph [0107] provides for the evaluation of relationships based on attributes derived from assets or events, which teaches the use of a second equivalence rule for determining similarity of the invariance identifying property.)
In reference to claim 21, The non-transitory computer readable medium storing specific computer-executable instructions of claim 19, wherein the grouping property is different than the invariance identifying property (Rieke: paragraph [0107] provides for the evaluation of relationships based on attributes derived from assets or events, which teaches the use of a second equivalence rule for determining similarity of the invariance identifying property.)
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. See PTO-892.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to AIDAN EDWARD SHAUGHNESSY whose telephone number is (703)756-1423. The examiner can normally be reached on Monday-Friday from 7:30am to 5pm.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson, can be reached at telephone number (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center and the Private Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from Patent Center or Private PAIR. Status information for unpublished applications is available through Patent Center and Private PAIR for authorized users only. Should you have questions about access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/patents/usptoautomated-interview-request-air-form.
/A.E.S./Examiner, Art Unit 2432
/Jeffrey Nickerson/Supervisory Patent Examiner, Art Unit 2432
Prosecution Insights