DETAILED ACTION
This office action is in response to the Amendments filed on 02/17/2026.
Claim 11 remains cancelled.
Claims 1-2, 7, 14, 15, 17, 19, and 21 are amended.
Claims 1-10, 12-21 are presented for examination.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments filed in Remarks pg. 9-14 on 02/17/2026 in view of 35 USC 103 rejections have been fully considered but they are not persuasive.
[a] “Applicant respectfully disagrees with the OA's characterization of the prior art. Applicant submits that the cited references, whether taken alone or in combination, fail to teach or suggest the specific configuration recited in claim 1, as amended, wherein the at least one of the match action units is configured to both process the network packets according to the forwarding information and produce measurement values for a network performance metric. The amendments to claim 1 clarify that the same match action units performs dual functions: packet processing according to forwarding information and measurement value production. This integrated functionality within hardware- implemented match action units represents a specific architectural configuration that is not disclosed or suggested by the cited references.
Kim discloses a PLT operator that detects latency metrics, but Kim does not teach or suggest that the same match action units that process packets according to forwarding information also produce measurement values. Rather, Kim's PLT operator appears to be a separate functional element from the match action units that perform packet forwarding operations. In contrast, the present application's claims require that at least one match action unit be configured to perform both functions-processing packets according to forwarding information and producing measurement values-within the same hardware unit. This architectural approach enables efficient inline telemetry collection without requiring separate dedicated measurement hardware. Miller discloses machine learning for anomaly detection but does not address the specific hardware architecture of match action units or their dual functionality as recited in claim 1, as amended.”
In response to [a], examiner respectfully disagrees. Applicant argues that due to the PLT operator performing the measurement value production, Kim does not teach the dual-purpose functionality of the match action units. However the PLT operator is a name for the set of match actions units and are configured by the control plane to to implement the PLT operator. As seen in Fig. 7 the control plane configures the MAUs to implement the PLT operator.
Col. 13 line 5-38“ In some embodiments, the control plane 112 configures the data processing circuits of the data plane to implement the PLT operator 130 and to perform message-forwarding operations through the data/control plane interface 765. In some embodiments, multiple MAU stages are needed to implement the PLT operator.
Therefore the MAUs perform both the packet forwarding operations as every MAU comprises message forwarding capability
col. 13 line 50-Col.14 line 8 “FIG. 8 illustrates an example of a match-action unit of some embodiments. As mentioned above, an ingress pipeline 740 or egress pipeline 742 in some embodiments has several MAU stages 732, each of which includes message-processing circuitry for forwarding received data messages and/or performing stateful operations based on these data messages. These operations are performed by processing values stored in the header vectors of the data messages.”,
As well as the generation of measurement values.
Col. 13 line 5-38“ As further described below, the MAU stages 732 in some embodiments include stateful arithmetic logic units with stateful memories, which allow the MAU stages to store PLT and PLF values, and implement learning filters in the data plane.
Therefore because of at least the reasons set forth above, Kim-Miller are maintained for these limitations.
[b] “Claim 17, as amended, recites receiving, by a central training node, initial measurement values from a plurality of edge nodes, wherein each of the edge nodes includes a hardware implemented packet processing pipeline circuit; producing, by the central training node, an unsupervised machine learning model from the initial measurement values; and deploying, by the central training node, the unsupervised machine learning model to the edge nodes for local anomaly detection. The application discloses this distributed architecture at paragraphs 54-55 and FIG. 1, which describe the central training node 110 receiving measurement streams from edge nodes 101, using unsupervised learning algorithm 112 to train central model 111, and deploying the trained central model 120 to edge nodes. Paragraphs 130-132 and FIG. 15 further describe the central training node 1502 receiving measurement streams and deploying trained models to edge nodes 1520. Paragraph 135 and FIG. 16 describe the central model deployment process. The OA has relied upon Duda and Lindo in combination with Kim and Miller to address the policy storage limitations, but the cited references do not teach or suggest the specific distributed architecture recited in claim 16, as amended, wherein a central training node receives initial measurement values from edge nodes having hardware implemented packet processing pipeline circuits, produces an unsupervised machine learning model from those values, and deploys the model back to the edge nodes for local anomaly detection.”
In response to [b], Claim 17 is rejected under a new combination of references, therefore this argument is moot.
[c] “Independent claim 19, as amended, recites a hardware implemented circuit including a specialized set of elements configured as the periodic measurement means and as the network traffic processing means such that at least one of the specialized set of elements concurrently performs packet processing and measurement production. The application discloses this at paragraphs 113-114 and FIG. 11, which describe that MPUs 1109 and 1111 of the match action pipeline 1108 are configured to implement traffic flow monitors 1110 and 1112 while simultaneously processing network packets according to forwarding information. This demonstrates that the same match action unit both processes packets and collects metrics concurrently. Paragraphs 95-96 and FIG. 7 further describe the match-action units performing concurrent operations within the pipeline, where each stage can match PHV fields to tables and update the PHV while also executing measurement-related actions. The cited references do not teach or suggest this concurrent performance of packet processing and measurement production by the same match action units.”
In response to [c], examiner respectfully disagrees. Similar to argument [a] in view of Claim 1, Kim discloses each MAU comprising both capabilities.
However the PLT operator is a name for the set of match actions units and are configured by the control plane to to implement the PLT operator. As seen in Fig. 7 the control plane configures the MAUs to implement the PLT operator.
Col. 13 line 5-38“ In some embodiments, the control plane 112 configures the data processing circuits of the data plane to implement the PLT operator 130 and to perform message-forwarding operations through the data/control plane interface 765. In some embodiments, multiple MAU stages are needed to implement the PLT operator.
Therefore the MAUs perform both the packet forwarding operations as every MAU comprises message forwarding capability
col. 13 line 50-Col.14 line 8 “FIG. 8 illustrates an example of a match-action unit of some embodiments. As mentioned above, an ingress pipeline 740 or egress pipeline 742 in some embodiments has several MAU stages 732, each of which includes message-processing circuitry for forwarding received data messages and/or performing stateful operations based on these data messages. These operations are performed by processing values stored in the header vectors of the data messages.”,
As well as the generation of measurement values.
Col. 13 line 5-38“ As further described below, the MAU stages 732 in some embodiments include stateful arithmetic logic units with stateful memories, which allow the MAU stages to store PLT and PLF values, and implement learning filters in the data plane.
Therefore because of at least the reasons set forth above, Kim-Miller are maintained for these limitations.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
In particular, Claims 19 and 20 recite in part:
Claim 19 “… forwarding information provided by a configuration means for configuring the network traffic processing means;
a network performance metric measurement policy storage means for storing network performance metric measurement policies; …
an anomaly detection means for detecting anomalous network traffic to or from workloads by detecting an anomaly in the measurement values; and
a reporting means for reporting the anomaly,
wherein: …
the anomaly detection means includes an unsupervised machine learning algorithm that uses an unsupervised machine learning model to detect the anomaly” and
Claim 20 “a network configuration means for updating a network configuration from a first network configuration to a second network configuration; and
a rollback triggering means for triggering a configuration rollback means to roll back the network configuration from the second network configuration to the first network configuration in response to detecting the anomalous network traffic to or from the workloads”
The functionalities tied to the means in Claim 19 and 20 correspond to Claims 1 and 14, wherein the functionalities are performed by the edge node using a CPU core and memory, further detailed in Fig. 4 430, and para.0069-para.0073.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 2, 4, 15, is/are rejected under 35 U.S.C. 103 as being unpatentable over Kim et al. (hereinafter Kim, US 10,447,597 B1) in view of Miller et al. (hereinafter Miller, US 2021/0216625 A1).
Regarding Claim 1, Kim discloses A system (Kim: Fig. 1 and 7) comprising:
a packet processing pipeline circuit implemented as an application specific integrated circuit (ASIC) and configured to implement a data plane (Kim: col. 6 lines 50-55 “while the data plane 110 of the forwarding element is implemented by application specific integrated circuit (ASIC) that is custom made to perform the data plane operations.” The data plane is implemented as an ASIC),
the packet processing pipeline circuit including match action units that are hardware implemented and arranged as a match action pipeline (Kim: Col .5 lines 58-Col. 6 line 8, “As shown, each hardware forwarding element 102-108 has (1) a set of data plane circuits 110 (the data plane 110) for forwarding data messages received along the data path to their destinations,” col. 12 lines 34-58 “As shown, the data plane 110 includes multiple message-processing pipelines, including multiple ingress pipelines 740 and egress pipelines 742. The data plane 110 also includes a traffic manager 744 that is placed between the ingress and egress pipelines 740 and 742. The traffic manager 744 serves as a crossbar switch that directs messages between different ingress and egress pipelines. Each ingress/egress pipeline includes a parser 730, several MAU stages 732, and a deparser 734.” seen in Fig. 1, but in more detail in Fig. 7. Fig. 7 110 shows a data plane with a plurality of MAUs, match action units, arranged in a pipeline. The data plane is implemented as an ASIC as in col. 6 lines 50-55 above, and therefore the MAU pipeline is hardware implemented.); and
a processor configured to implement a control plane that configures the data plane to process network packets (Kim: col. 5 line 30-45 “One of ordinary skill in the art will recognize that the term data message may be used herein to refer to various formatted collections of bits that may be sent across a network, such as Ethernet frames, IP packets” col. 13 lines 17-21 “In some embodiments, the control plane 112 configures the data processing circuits of the data plane to implement the PLT operator 130 and to perform message-forwarding operations through the data/control plane interface 765.”) according to forwarding information provided by the control plane to the data plane (Kim: col. 13 line 50-Col.14 line 8 “FIG. 8 illustrates an example of a match-action unit of some embodiments. As mentioned above, an ingress pipeline 740 or egress pipeline 742 in some embodiments has several MAU stages 732, each of which includes message-processing circuitry for forwarding received data messages and/or performing stateful operations based on these data messages. These operations are performed by processing values stored in the header vectors of the data messages. As shown in FIG. 8, the MAU 732 in some embodiments has a set of one or more match tables 805, a data plane stateful processing unit 810 (DSPU), a set of one or more stateful tables 815, an action crossbar 830, an action parameter memory 820, an action instruction memory 825, and an action arithmetic logic unit (ALU) 835. The match table set 805 can compare one or more fields in a received message's header vector (HV) to identify one or more matching flow entries (i.e., entries that match the message's HV). The match table set can include TCAM tables or exact match tables in some embodiments. In some embodiments, the match table set can be accessed at an address that is a value extracted from one or more fields of the message's header vector, or it can be a hash of this extracted value. In some embodiments, the local control plane or a remote controller supplies flow entries (e.g., the flow-match identifiers and/or action identifiers) to store in one or more match tables” the data plane comprises of match action units, as seen in Fig. 7 and col. 12 lines 34-58, and the match action units contains flow entries for its match tables, the forwarding information.),
providing, by the control plane, the forwarding information to the data plane (Kim: col. 13 line 50-Col.14 line 8 “In some embodiments, the local control plane or a remote controller supplies flow entries (e.g., the flow-match identifiers and/or action identifiers) to store in one or more match tables” control plane provides flow match identifiers for forwarding to the data plane.);
configuring, by the control plane, at least one of the match action units to both process the network packets according to the forwarding information and produce measurement values for a network performance metric (Kim: col. 13 line 50-Col.14 line 8 “FIG. 8 illustrates an example of a match-action unit of some embodiments. As mentioned above, an ingress pipeline 740 or egress pipeline 742 in some embodiments has several MAU stages 732, each of which includes message-processing circuitry for forwarding received data messages and/or performing stateful operations based on these data messages. These operations are performed by processing values stored in the header vectors of the data messages.” Col. 13 line 5-38“In some embodiments, the control plane 112 configures the data processing circuits of the data plane to implement the PLT operator 130 and to perform message-forwarding operations through the data/control plane interface 765. In some embodiments, multiple MAU stages are needed to implement the PLT operator. In these embodiments, earlier MAU stages write their outputs to the processed header vectors in order to make these outputs available for subsequent MAU stages that also implement the PLT operator. ” col. 1 lines 52-col.2 line 8 “this data plane PLT operator in some embodiments can also quickly detect whether the hop latency has significantly changed at one or more forwarding elements along the flow's path…. After detecting a new data message flow, or detecting path or latency changes for a previously detected data message flow, the PLT operator of the last hop forwards to a control plane process of the last hop or of another device the path information (e.g., the forwarding element identifiers) and latency values (e.g., hop latency values of the forwarding elements along the path) that are embedded in the new data message's header. ” Each MAU is configured to forward the messages, and further implement the PLT operator that produces measurement values.);
processing, by the at least one of the match action units, the network packets according to the forwarding information (Kim: col 14 lines 40-35 “The action ALU 835 also receives an instruction to execute from the action instruction memory 825. This memory 825 retrieves the instruction from its record that is identified by the address provided by the match table set 805. The action ALU 835 also receives the header vector for each message that the MAU processes. Such a header vector can also contain a portion or the entirety of an instruction to process and/or a parameter for processing the instruction. The action ALU 835 in some embodiments is a very large instruction word (VLIW) processor. The action ALU 835 executes instructions (from the instruction memory 835 or the header vector) based on parameters received on the action parameter bus 840 or contained in the header vector. The action ALU stores the output of its operation in the header vector in order to effectuate a message forwarding operation and/or stateful operation of its MAU stage 732. The output of the action ALU forms a modified header vector (HV′) for the next MAU stage.,” using the forwarding information from the match tables as established in col. 13 line 50 to col. 14 line 8, the packets are processed by the ALU of the MAU as seen in Fig. 8 that represents MAU 732 as in Fig. 7);
producing, by the at least one of the match action units, the measurement values for the network performance metric in response to receiving the network packets; (Kim: col. 1 line 44-52 “In some embodiments, the fast PLT operator in a forwarding element's data plane (1) detects a data message flow that is new for that forwarding element (e.g., a data message flow that is or appears to be a new data message flow for the forwarding element), (2) identifies the path (through the set of prior forwarding elements) traversed by the new data message flow to the forwarding element, and (3) identifies the latency that the data message flow is experiencing at each prior forwarding element on the path. The discussion below refers to each forwarding element traversed by a data message as a hop along the path.” Col. 13 line 5-38“ As further described below, the MAU stages 732 in some embodiments include stateful arithmetic logic units with stateful memories, which allow the MAU stages to store PLT and PLF values, and implement learning filters in the data plane. These components operate at data line rates, which allow them to implement the PLT operator to operate at data line rates….In some embodiments, the control plane 112 configures the data processing circuits of the data plane to implement the PLT operator 130 and to perform message-forwarding operations through the data/control plane interface 765. In some embodiments, multiple MAU stages are needed to implement the PLT operator. In these embodiments, earlier MAU stages write their outputs to the processed header vectors in order to make these outputs available for subsequent MAU stages that also implement the PLT operator. ” As data message flow, comprising of network packets, traverses between the forwarded elements, such as in Fig. 1 path 120, the network metric such as latency is identified. This is performed by the PLT operator, and as can be seen in col. 13 5-38, the PLT operator is implemented by the multiple MAU stages.); and
reporting an anomaly in the measurement values in response to detecting the anomaly (Kim: col. 1 lines 52-col.2 line 8 “After detecting a new data message flow, or detecting path or latency changes for a previously detected data message flow, the PLT operator of the last hop forwards to a control plane process of the last hop or of another device the path information (e.g., the forwarding element identifiers) and latency values (e.g., hop latency values of the forwarding elements along the path) that are embedded in the new data message's header. ” when changes to path or latency is detected, i.e. anomalous data, this is reported to the control plane.)
wherein the packet processing pipeline circuit is a hardware implemented pipeline circuit (Kim: col. 6 lines 50-55 “As further described below, the control plane 112 of a forwarding element is implemented by one or more general purpose central processing units (CPUs), while the data plane 110 of the forwarding element is implemented by application specific integrated circuit (ASIC) that is custom made to perform the data plane operations.” The data plane comprising of match action units in Fig. 7 and 8, is implemented in hardware circuitry in an ASIC or FPGA in col. 17 line 5-10.).
While Kim discloses a learning filter aspect to the packet processing in col.11 and 13, Kim does not explicitly disclose wherein the control plane and the data plane are configured to use unsupervised machine learning to detect anomalous network traffic by: reporting an anomaly in the measurement values in response to an unsupervised machine learning algorithm using an unsupervised machine learning model to detect the anomaly.
Miller discloses wherein the control plane and the data plane are configured to use unsupervised machine learning to detect anomalous network traffic by (Miller: para.0180 “The FPGA-accelerated servers and the GPU-accelerated servers described above may implement a model of computing where, rather than keeping a small amount of data in a CPU and running a long stream of instructions over it as occurred in more traditional computing models, the machine learning model and parameters are pinned into the high-bandwidth on-chip memory with lots of data streaming though the high-bandwidth on-chip memory. FPGAs may even be more efficient than GPUs for this computing model, as the FPGAs can be programmed with only the instructions needed to run this kind of computing model.” para.0410 “At operation 1902, a machine learning model is trained (e.g., by system 400 and/or any other system) to detect anomalies associated with read/write traffic processed by a storage system. The machine learning model may be supervised and/or unsupervised as may serve a particular implementation and may be configured to implement one or more decision tree learning algorithms, association rule learning algorithms, artificial neural network learning algorithms, deep learning algorithms, bitmap algorithms, and/or any other suitable data analysis technique as may serve a particular implementation. In some examples, the machine learning model is trained with actual ransomware payloads.” The instructions from the processor, control plane, and the actual performance of the instructions, the data plane, are designed to use Machine learning model, built into the FPGA or ASIC to detect anomalies in network traffic.):
reporting an anomaly in the measurement values in response to an unsupervised machine learning algorithm using an unsupervised machine learning model to detect the anomaly (Miller: para.0338 “At decision 804, system 400 determines whether a total amount of read and write traffic exceeds a threshold. At decision 806, system 400 determines whether the write traffic is less compressible than the read traffic. If the total amount of read and write traffic exceeds the threshold (“Yes” at decision 804) and the write traffic is less compressible, or has a far high number of incompressible blocks than the read traffic, than the read traffic (“Yes” at decision 806), system 400 determines at operation 808 that the storage system is possibly being targeted by a security threat.” para.0413 “At operation 1906, system 400 determines, based on an output of the machine learning model, that the storage system is possibly being targeted by a security threat. This may be performed in any suitable manner.” para.0410 “The machine learning model may be supervised and/or unsupervised” para.0452 “In some examples, system 400 may notify the remote storage system of the security threat so that the remote storage system may abstain from deleting the recovery dataset until one or more conditions are fulfilled.” anomaly can be detected and reported using unsupervised machine learning algorithm).
Therefore, it would have been obvious to one ordinary skill in the art before the effective filing date of the claimed invention to combine Kim and Miller in order to incorporate wherein the control plane and the data plane are configured to use unsupervised machine learning to detect anomalous network traffic by: reporting an anomaly in the measurement values in response to an unsupervised machine learning algorithm using an unsupervised machine learning model to detect the anomaly.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit that comes with the addition of AI and machine learning techniques, such as automated growth, correction and accuracy over time (Miller: para.0152-0154).
Regarding Claim 2, Kim-Miller discloses claim 1 as set forth above.
Kim further discloses the control plane configures at least one of the match action units to process at least one of the network packets according to the forwarding information (Kim: col. 13 lines 17-30 “In some embodiments, the control plane 112 configures the data processing circuits of the data plane to implement the PLT operator 130 and to perform message-forwarding operations through the data/control plane interface 765. ” col. 13 line 50-Col.14 line 8 “In some embodiments, the local control plane or a remote controller supplies flow entries (e.g., the flow-match identifiers and/or action identifiers) to store in one or more match tables” control plane provides flow match identifiers for forwarding to the match tables of the match action units of a data plane.).
Regarding Claim 4, Kim-Miller discloses claim 1 as set forth above.
Kim further discloses the network performance metric is a transmission control protocol (TCP) metric or a user datagram protocol (UDP) metric (Kim: col. 5 lines 30-45 “As used in this document, a data message generically refers to a collection of bits in a particular format sent across a network. One of ordinary skill in the art will recognize that the term data message may be used herein to refer to various formatted collections of bits that may be sent across a network, such as Ethernet frames, IP packets, TCP segments, UDP datagrams, etc. Also, as used in this document, references to L2, L3, L4, and L7 layers (or layer 2, layer 3, layer 4, layer 7) are references respectively to the second data link layer, the third network layer, the fourth transport layer, and the seventh application layer of the OSI (Open System Interconnection) layer model.” col. 1 lines 52-col.2 line 8 “For a previously detected data message flow, the data plane PLT operator in some embodiments can also quickly detect whether the data message flow has changed the path that it has taken to the forwarding element (i.e., whether one or more forwarding elements have been added and/or removed to the set of prior forwarding elements traversed by the received data message). Also, for a previously detected data message flow, this data plane PLT operator in some embodiments can also quickly detect whether the hop latency has significantly changed at one or more forwarding elements along the flow's path…. After detecting a new data message flow, or detecting path or latency changes for a previously detected data message flow, the PLT operator of the last hop forwards to a control plane process of the last hop or of another device the path information (e.g., the forwarding element identifiers) and latency values (e.g., hop latency values of the forwarding elements along the path) that are embedded in the new data message's header. ” the data messages that are analyzed in Kim include TCP segments and UDP datagrams, and consider many other layers of OSI when analyzing latency. Examiner also notes that para.00124 of applicants specification include TCP metrics including latency and round trip time, and further leaves the definition of TCP and UDP metrics open ended. Therefore, the latency measures in Kim that include TCP segments are at least a TCP metric.).
Regarding Claim 15, Kim-Miller discloses claim 1 as set forth above.
However Kim does not explicitly disclose wherein the network performance metric is a storage metric.
Miller discloses wherein the network performance metric is a storage metric (Miller: para.0336 “System 400 may monitor read and write traffic in any suitable manner. For example, system 400 may analyze metrics generated by the storage system and/or a cloud-based monitoring system (e.g., cloud-based monitoring system 602) that are representative of an amount of read and write traffic, the type of data included in the read and write traffic, a source of the read and/or write traffic, timestamp data indicative of a date and/or time that the read and write traffic occurs, and/or any other attribute of the read and write traffic as may serve a particular implementation.” Metrics related to storage may be collected and analyzed, such as a volume of read/write traffic).
Therefore, it would have been obvious to one ordinary skill in the art before the effective filing date of the claimed invention to combine Kim and Miller in order to incorporate wherein the network performance metric is a storage metric.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security by analyzing other types of metrics from read/write traffic (Miller: para.0314).
Claim(s) 3, 6, 13 is/are rejected under 35 U.S.C. 103 as being unpatentable over Kim et al. (hereinafter Kim, US 10,447,597 B1) in view of Miller et al. (hereinafter Miller, US 2021/0216625 A1) in view of Vasseur et al. (hereinafter Vasseur, US 2020/0382385 A1).
Regarding Claim 3, Kim-Miller discloses claim 1 as set forth above.
However Kim does not explicitly disclose a central training node configured to produce the unsupervised machine learning model from initial measurement values for the network performance metric; and wherein detecting the anomaly includes installing the unsupervised machine learning model in response to receiving the unsupervised machine learning model from the central training node.
Miller further a central training node configured to produce the unsupervised machine learning model (Miller: para.0410 “At operation 1902, a machine learning model is trained (e.g., by system 400 and/or any other system) to detect anomalies associated with read/write traffic processed by a storage system.” a separate entity trains a machine learning model).
Therefore, it would have been obvious to one ordinary skill in the art before the effective filing date of the claimed invention to combine Kim and Miller in order to incorporate a central training node configured to produce the unsupervised machine learning model.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit that comes with the addition of AI and machine learning techniques, such as automated growth, correction and accuracy over time (Miller: para.0152-0154).
However Kim-Miller does not explicitly disclose a central training node configured to produce the unsupervised machine learning model from initial measurement values for the network performance metric; and wherein detecting the anomaly includes installing the unsupervised machine learning model in response to receiving the unsupervised machine learning model from the central training node.
Vasseur discloses a central training node (Vasseur: Fig. 5 supervisory service 310) configured to produce the unsupervised machine learning model (Vasseur: para.0034 “In various embodiments, routing process 248 may employ one or more supervised, unsupervised, or semi-supervised machine learning models.”) from initial measurement values for the network performance metric (Vasseur: para.0073-0077 “[0073] The nature of the tunnel, as well as the network configuration, are essential to predicting the SLA under various traffic conditions. To this end, WIE module 502 on each edge device, such as device 308, may report the following information 510 to supervisory service 310 for machine learning model training: [0074] The traffic conditions X described above, at regular time steps and for each tunnel. [0075] The corresponding observed SLAs Y, at regular time steps and for each tunnel. [0076] Contextual information C about the edge device and each of the tunnels.” see Fig. 5. the edge device sends its initial measurement sets of traffic metrics and SLAs, and provides to Supervisory Service 310, para.0072 “In one embodiment, the model is trained in the cloud (e.g., by supervisory service 310), based on information 510 pushed by the various edge devices 308.” para.0061 “FIG. 4C illustrates an alternate implementation 410 in which supervisory service 310 pushes the failure prediction model to device 308 for local/on-premise inference.” the supervisory service trains a model to detect anomalies, in this case detect anomalies that are indicative of a failure prediction); and
wherein detecting the anomaly includes installing the unsupervised machine learning model in response to receiving the unsupervised machine learning model from the central training node (Vasseur: para.0072 “The role of WIE module 502 is then to estimate the SLA for the backup tunnel when charged with traffic described by that probability distribution. In various embodiments, WIE module 502 achieves this using one or more machine learning models. In one embodiment, the model is trained in the cloud (e.g., by supervisory service 310), based on information 510 pushed by the various edge devices 308. Regularly, the machine learning model is re-trained, either from scratch or incrementally, and the updated model, such as model 412) is pushed back to the WIE module 502 on each of the edge devices.” the model trained by the supervisory service 310 is then sent and installed on the device 308 in Fig. 5, and used by the module 502).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Kim-Miller with Vasseur in order to incorporate a central training node configured to produce the unsupervised machine learning model from initial measurement values for the network performance metric; and wherein detecting the anomaly includes installing the unsupervised machine learning model in response to receiving the unsupervised machine learning model from the central training node.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of reduced strain on the device by offloading its training to a remote service (Vasseur: para.0072).
Regarding Claim 6, Kim-Miller discloses claim 1 as set forth above.
However Kim-Miller does not explicitly disclose the control plane and the data plane are further configured to adapt the unsupervised machine learning model for detecting anomalies in the measurement values until the unsupervised machine learning model meets a goodness of fit criterion.
Vasseur discloses the control plane and the data plane are further configured to adapt the unsupervised machine learning model (Vasseur: para.0034 “In various embodiments, routing process 248 may employ one or more supervised, unsupervised, or semi-supervised machine learning models.”) for detecting anomalies in the measurement values until the unsupervised machine learning model meets a goodness of fit criterion (Vasseur: para.0033 “For instance, in the context of classification, the model M may be a straight line that separates the data into two classes (e.g., labels) such that M=a*x+b*y+c and the cost function would be the number of misclassified points. The learning process then operates by adjusting the parameters a,b,c such that the number of misclassified points is minimal. After this optimization phase (or learning phase), the model M can be used very easily to classify new data points. Often, M is a statistical model, and the cost function is inversely proportional to the likelihood of M, given the input data.” models are trained until they meet some goodness to fit criterion, in this case a misclassification criterion.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Kim-Miller with Vasseur in order to incorporate the control plane and the data plane are further configured to adapt the unsupervised machine learning model for detecting anomalies in the measurement values until the unsupervised machine learning model meets a goodness of fit criterion.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improving accuracy of a model (Vasseur: para.0072, para.0033).
Regarding Claim 13, Kim-Miller discloses claim 1 as set forth above.
However Kim-Miller does not explicitly disclose a central training node configured to produce the unsupervised machine learning model from initial measurement values for the network performance metric; and wherein the central training node is configured to provide the unsupervised machine learning model to edge nodes configured to use the unsupervised machine learning model to detect the anomalous network traffic.
Vasseur discloses a central training node configured to produce the unsupervised machine learning model (Vasseur: para.0034 “In various embodiments, routing process 248 may employ one or more supervised, unsupervised, or semi-supervised machine learning models.”) from initial measurement values for the network performance metric (Vasseur: para.0072 “. In one embodiment, the model is trained in the cloud (e.g., by supervisory service 310), based on information 510 pushed by the various edge devices 308.” based on information received from each edge node, a central model is generated by supervisory service 210, the central training node.); and
wherein the central training node is configured to provide the unsupervised machine learning model to edge nodes configured to use the unsupervised machine learning model to detect the anomalous network traffic (Vasseur: para.0072 “The role of WIE module 502 is then to estimate the SLA for the backup tunnel when charged with traffic described by that probability distribution. In various embodiments, WIE module 502 achieves this using one or more machine learning models. In one embodiment, the model is trained in the cloud (e.g., by supervisory service 310), based on information 510 pushed by the various edge devices 308. Regularly, the machine learning model is re-trained, either from scratch or incrementally, and the updated model, such as model 412) is pushed back to the WIE module 502 on each of the edge devices.” the model trained by the supervisory service 310 is then sent and installed on the device 308 in Fig. 5, and used by the module 502).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Kim-Miller with Vasseur in order to incorporate a central training node configured to produce the unsupervised machine learning model from initial measurement values for the network performance metric; and wherein the central training node is configured to provide the unsupervised machine learning model to edge nodes configured to use the unsupervised machine learning model to detect the anomalous network traffic.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of reduced strain on the device by offloading its initial training to a remote service and improving accuracy of a model (Vasseur: para.0072, para.0033).
Claim(s) 5, 9, 12 is/are rejected under 35 U.S.C. 103 as being unpatentable over Kim et al. (hereinafter Kim, US 10,447,597 B1) in view of Miller et al. (hereinafter Miller, US 2021/0216625 A1) in view of Mishra et al. (hereinafter Mishra, US 2017/0199902 A1).
Regarding Claim 5, Kim-Miller discloses claim 1 as set forth above.
However while Kim-Miller discloses the usage of unsupervised Machine learning techniques (Miller: para.0410 “The machine learning model may be supervised and/or unsupervised”), it does not explicitly disclose wherein the unsupervised machine learning model is a random cut forest model; and the control plane and the data plane are configured to adapt the random cut forest model for detecting additional anomalies in measurement values by adding one of the measurement values to one of a plurality of trees of the random cut forest model.
Mishra discloses wherein the machine learning model is a random cut forest model (Mishra: para.0019 “In at least some embodiments clients of the SMAS may request the detection of unusual or anomalous observation records in a specified stream using the SMAS programmatic interfaces. (The terms “outlier” and “anomaly” may be used synonymously herein to refer to such records.) In response to such a request, the service may provide the results of applying an efficient outlier detection algorithm which uses a random cut forest-based technique on the stream's observation records in various embodiments.” a random cut forest technique is used to detect anomalous data.); and
the control plane and the data plane are configured to adapt the random cut forest model for detecting additional anomalies in the measurement values by adding one of the measurement values to one of a plurality of trees of the random cut forest model (Mishra: para.0019 “It is noted that in the remainder of this document, the action of inserting a node representing a record into a tree may be referred to simply as “inserting a record” into the tree; similarly, the phrase “deleting a record” from a tree may be used to refer to the action of deleting the node representing the record from the tree.” as explained above, in view of applicants specification para.0050, the control instructions and control elements are the control plane, and the performance of the instructions and elements that perform the instructions are the data plane. Mishra shows in para.0019 that new observations are inserted into trees, for example para.0040 “As shown in element 259, zero or more of the trees may be probabilistically updated by actually inserting a given observation record (and deleting a node to keep the sample size unchanged).”).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Kim-Miller with Mishra in order to incorporate wherein the machine learning model is a random cut forest model; and the control plane and the data plane are configured to adapt the random cut forest model for detecting additional anomalies in the measurement values by adding one of the measurement values to one of a plurality of trees of the random cut forest model, and apply this idea to the unsupervised machine learning process of Miller.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved performance for detecting security anomalies (Mishra: para.0001-0003).
Regarding Claim 9, Kim-Miller discloses claim 1 as set forth above.
However Kim does not explicitly disclose a second unsupervised machine learning algorithm adapts a second machine learning model for detecting anomalies in the measurement values; the unsupervised machine learning algorithm uses the second machine learning model to detect a second anomaly; and the second machine learning model is a random cut forest learning algorithm.
Miller further discloses a second unsupervised machine learning algorithm adapts a second machine learning model for detecting anomalies in the measurement values (Miller: para.0156 “Data is the heart of modern AI and deep learning algorithms. Before training can begin, one problem that must be addressed revolves around collecting the labeled data that is crucial for training an accurate AI model. A full scale AI deployment may be required to continuously collect, clean, transform, label, and store large amounts of data. Adding additional high quality data points directly translates to more accurate models and better insights…. 3) exploring parameters and models, quickly testing with a smaller dataset, and iterating to converge on the most promising models to push into the production cluster, 4) executing training phases to select random batches of input data, including both new and older samples, and feeding those into production GPU servers for computation to update model parameters… Rarely is the ingested data used for only one purpose, and shared storage gives the flexibility to train multiple different models or apply traditional analytics to the data.” a plurality of models are trained using the measurement values.);
the unsupervised machine learning algorithm (Miller: para.0410 “The machine learning model may be supervised and/or unsupervised”) uses the second machine learning model to detect a second anomaly (Miller: para.0413 “At operation 1906, system 400 determines, based on an output of the machine learning model, that the storage system is possibly being targeted by a security threat. This may be performed in any suitable manner. For example, the output of the machine learning may include a confidence score. If the confidence score is above a certain threshold, system 400 may determine that the storage system is possibly being targeted by a security threat.” it is disclosed above in at least para.0156 a plurality of different machine learning models are trained and used, and a different machine learning model of the system maye be used to detect a separate anomaly).
Therefore, it would have been obvious to one ordinary skill in the art before the effective filing date of the claimed invention to combine Kim and Miller in order to incorporate a second unsupervised machine learning algorithm adapts a second machine learning model for detecting anomalies in the measurement values, the unsupervised machine learning algorithm uses the second machine learning model to detect a second anomaly
One of ordinary skill in the art would have been motivated to combine because of the expected benefit that comes with the addition of AI and machine learning techniques, such as automated growth, correction and accuracy over time (Miller: para.0152-0154).
However Kim-Miller does not explicitly disclose the second machine learning model is a random cut forest learning algorithm.
Mishra discloses the second machine learning model is a random cut forest learning algorithm (Mishra: para.0019 “In at least some embodiments clients of the SMAS may request the detection of unusual or anomalous observation records in a specified stream using the SMAS programmatic interfaces. (The terms “outlier” and “anomaly” may be used synonymously herein to refer to such records.) In response to such a request, the service may provide the results of applying an efficient outlier detection algorithm which uses a random cut forest-based technique on the stream's observation records in various embodiments.” a random cut forest technique is used to detect anomalous data.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Kim-Miller with Mishra in order to incorporate the second machine learning model is a random cut forest learning algorithm.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved performance for detecting security anomalies (Mishra: para.0001-0003).
Regarding Claim 12, Kim-Miller discloses claim 1 as set forth above.
However Kim does not explicitly disclose wherein the unsupervised machine learning algorithm is a random cut forest learning algorithm.
Miller further discloses the unsupervised machine learning algorithm (Miller: para.0410 “The machine learning model may be supervised and/or unsupervised”) uses the second machine learning model to detect a second anomaly (Miller: para.0413 “At operation 1906, system 400 determines, based on an output of the machine learning model, that the storage system is possibly being targeted by a security threat. This may be performed in any suitable manner. For example, the output of the machine learning may include a confidence score. If the confidence score is above a certain threshold, system 400 may determine that the storage system is possibly being targeted by a security threat.” it is disclosed above in at least para.0156 a plurality of different machine learning models are trained and used, and a different machine learning model of the system maye be used to detect a separate anomaly).
Therefore, it would have been obvious to one ordinary skill in the art before the effective filing date of the claimed invention to combine Kim and Miller in order to incorporate the unsupervised machine learning algorithm.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit that comes with the addition of AI and machine learning techniques, such as automated growth, correction and accuracy over time (Miller: para.0152-0154).
However Kim-Miller does not explicitly disclose wherein the unsupervised machine learning algorithm is a random cut forest learning algorithm.
Mishra discloses wherein the machine learning algorithm is a random cut forest learning algorithm (Mishra: para.0019 “In at least some embodiments clients of the SMAS may request the detection of unusual or anomalous observation records in a specified stream using the SMAS programmatic interfaces. (The terms “outlier” and “anomaly” may be used synonymously herein to refer to such records.) In response to such a request, the service may provide the results of applying an efficient outlier detection algorithm which uses a random cut forest-based technique on the stream's observation records in various embodiments.” a random cut forest technique is used to detect anomalous data.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Kim-Miller with Mishra in order to incorporate wherein the machine learning algorithm is a random cut forest learning algorithm, and apply to the unsupervised machine learning of Miller.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved performance for detecting security anomalies (Mishra: para.0001-0003).
Claim(s) 7, 14, is/are rejected under 35 U.S.C. 103 as being unpatentable over Kim et al. (hereinafter Kim, US 10,447,597 B1) in view of Miller et al. (hereinafter Miller, US 2021/0216625 A1) in view of Magerramov et al. (hereinafter Mage, US 10,122,578 B1).
Regarding Claim 7, Kim-Miller discloses claim 1 as set forth above.
However Kim-Miller does not explicitly disclose wherein the control plane and the data plane are further configured to roll back a configuration update based on in response to a number of detected anomalies exceeding a predetermined threshold.
Mage discloses wherein the control plane and the data plane are further configured to roll back a configuration update based on in response to a number of detected anomalies exceeding a predetermined threshold (Mage: col. 17 lines 45-62 “If, in element 1114, a determination is made that the number of packets dropped amongst the network devices over the predetermined period of time exceeds the dropped packet threshold value, then the method continues in element 1118 with generating an alarm. … In some embodiments, the alarm is transmitted to the control plane 108 via distribution plane 140. In element 1120, the transmission of command instructions is cancelled and/or the networking devices that received the command instruction are returned to a previous state. … In other words, in response to receiving the alarm, the command instruction generation logic 410 may generate a command instruction that causes the network devices 126A-N and/or 128A-N that have already received the command instruction containing the network configuration change request 212 and implemented the network configuration change request 212 to revert to the state the network devices were in prior to implementing the network configuration change request 212.” Upon detecting a threshold number of anomalies, i.e. number of packets drops, the configuration change is reverted. Fig. 1 control plane 108 data plane 132.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Kim-Miller with that of Mage in order to incorporate wherein the control plane and the data plane are further configured to roll back a configuration update based on in response to a number of detected anomalies exceeding a predetermined threshold.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved performance by reverting a change that causes anomalies (Mage: col. 17 lines 45-62)
Regarding Claim 14, Kim-Miller discloses claim 1 as set forth above.
However Kim-Miller does not explicitly disclose wherein: a node that includes the control plane is configured to: increment an anomaly counter in response to detecting the anomalous network traffic; and automatically roll back a network configuration update in response to the anomaly counter exceeding a maximum allowable anomalies value.
Mage discloses wherein: a node that includes the control plane is configured to: increment an anomaly counter in response to detecting the anomalous network traffic (Mage: col. 17 lines 45-62 “If, in element 1114, a determination is made that the number of packets dropped amongst the network devices over the predetermined period of time exceeds the dropped packet threshold value, then the method continues in element 1118 with generating an alarm.” Upon detecting a threshold number of anomalies, i.e. number of packets drops, the configuration change is reverted. Fig. 1 control plane 108, a counter that counts the number of packets dropped is incremented and compared to a threshold.); and
automatically roll back a network configuration update in response to the anomaly counter exceeding a maximum allowable anomalies value (Mage: col. 17 lines 45-62 “In other words, in response to receiving the alarm, the command instruction generation logic 410 may generate a command instruction that causes the network devices 126A-N and/or 128A-N that have already received the command instruction containing the network configuration change request 212 and implemented the network configuration change request 212 to revert to the state the network devices were in prior to implementing the network configuration change request 212.” Upon detecting a threshold number of anomalies, i.e. number of packets drops, an alarm is generated and the configuration change is reverted.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Kim-Miller with that of Mage in order to incorporate wherein: a node that includes the control plane is configured to: increment an anomaly counter in response to detecting the anomalous network traffic; and automatically roll back a network configuration update in response to the anomaly counter exceeding a maximum allowable anomalies value.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved performance by reverting a change that causes anomalies (Mage: col. 17 lines 45-62)
Claim(s) 8 is/are rejected under 35 U.S.C. 103 as being unpatentable over Kim et al. (hereinafter Kim, US 10,447,597 B1) in view of Miller et al. (hereinafter Miller, US 2021/0216625 A1) in view of Kulkarni et al. (hereinafter Kulkarni, US 2017/0118270 A1).
Regarding Claim 8, Kim-Miller discloses claim 1 as set forth above.
Kim further discloses a memory configured to store the measurement values (Kim: Fig. 7 memory 794 col. 13 line 39-50 “The control plane 112 includes one or more processors 792 (such as a microprocessor with multiple processing cores or units) that execute instructions and a memory 794 that stores instructions.” Col. 7 line 39-col. 8 line 18 “ For instance, in some embodiments, only the PLT operators of the last hops report PLT data to the control plane processes, while the PLT operators of the other hops insert encoded path and latency values that assist the last hop to quickly detect changes to path and latency values for flows that it terminates…The control plane process then creates connection records for the reported PLT data when such data is accurate (as the PLT operators of some embodiments might report false positive PLT events)” the control plane comprises a memory, and is provided reports from PLT operators, and processes the measurement data.);
a hardware implemented register interface (Kim: col. 13 lines 18-38 “ Also, the implemented PLT operator writes publishes its PLT and PLF values to the control plane 112 through the data plane/control plane interface 765. In some embodiments, the PLT operator writes these values to specific registers in this interface. ” the data plane uses a register interface); and
However Kim does not explicitly disclose a memory configured to store the unsupervised machine learning model; wherein using unsupervised machine learning to detect the anomalous network traffic includes the packet processing pipeline circuit using update logic in the hardware implemented register interface to update the measurement values.
Miller further discloses further including: a memory configured to store the plurality of measurement values and the unsupervised machine learning model (Miller: para.0411 “In some examples, the machine learning model is trained using honeypot files, sectors of blocks, and/or any other data structure configured to serve as a decoy for ransomware and other security threats. These honeypot data structures may be maintained by system 400 at any suitable location (e.g., within the storage system or remote from the storage system).” para.0316 “For example, storage facility 402 may store instructions 406 that may be executed by processing facility 404 to perform any of the operations described herein. Instructions 406 may be implemented by any suitable application, software, code, and/or other executable data instance. Storage facility 402 may also maintain any data received, generated, managed, used, and/or transmitted by processing facility 404. Storage facility 402 may additionally maintain any other suitable type of data as may serve a particular implementation.” data protection system 400 contains a storage facility that maintains any type of data associated with the system as a whole and processing. Therefore includes the machine learning model used as well as any measurement values used, for example in that of Fig. 19 in para.0409-0413.).
Therefore, it would have been obvious to one ordinary skill in the art before the effective filing date of the claimed invention to combine Kim and Miller in order to incorporate a memory configured to store the unsupervised machine learning model.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit that comes with the addition of AI and machine learning techniques, such as automated growth, correction and accuracy over time (Miller: para.0152-0154).
However Kim-Miller does not explicitly disclose wherein using unsupervised machine learning to detect the anomalous network traffic includes the packet processing pipeline circuit using update logic in the hardware implemented register interface to update the measurement values.
Kulkarni discloses detect anomalous network traffic includes the ethernet switch using update logic in the hardware implemented register interface to update the measurement values (Kulkarni: para.0048 “The Ethernet switch IC 300 also includes MIB Counters used for monitoring and analyzing network performance at the multiple ports, and generating MIB statistics diagnostic information quantifying the analysis of the network performance. The MIB statistics can include a total number of packets received, total number of packets transmitted, number of broadcast, multicast and unicast packets received and transmitted, and number of packets received and transmitted having different packet sizes. The MIB counters are also used for detecting network anomalies such as received dropped packets, source address changes, undersize packets, oversize packets, fragments having packet size less than a minimum Ethernet frame size of 64 bytes, alignment errors, frame check sequence errors, symbol errors, collisions on transmit interface (single as well as multiple), and discarded packets. Certain components in the system 100 rely on the MIB statistics for network management of fault tolerant Ethernet (FTE) networks. The Ethernet switch IC 300 stores the MIB statistics in its internal set of MIB registers 304 for each of the ports.” the switch detects anomalous data by analyzing MIB counter data, and the results of the analysis are set to the MIB registers).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Kim-Miller with Kulkarni in order to incorporate detect anomalous network traffic includes the ethernet switch using update logic in the hardware implemented register interface to update the measurement values, and apply this idea to the unsupervised machine learning by the packet processing pipeline circuit as taught by Kim-Miller.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved performance that comes with detection of anomalous data (Kulkarni: para.0048).
Claim(s) 10 is/are rejected under 35 U.S.C. 103 as being unpatentable over Kim et al. (hereinafter Kim, US 10,447,597 B1) in view of Miller et al. (hereinafter Miller, US 2021/0216625 A1) in view of Vasseur et al. (hereinafter Vasseur, US 2016/0219070 A1).
Regarding Claim 10, Kim-Miller discloses claim 1 as set forth above.
However Kim-Miller does not explicitly disclose wherein the unsupervised machine learning algorithm is a clustering algorithm.
Vasseur further discloses wherein the unsupervised machine learning algorithm is a clustering algorithm (Vasseur: para.0040 “un-supervised …Example machine learning techniques that may be used to construct and analyze such a model may include, but are not limited to, … clustering techniques (e.g., k-means, etc.),” the types of machine learning algorithm includes clustering techniques).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Kim-Miller with Vasseur in order to incorporate wherein the unsupervised machine learning algorithm is a clustering algorithm.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security that comes with detection of attacks (Vasseur: para.0003-0004).
Claim(s) 16, 18, 19, and 21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Kim et al. (hereinafter Kim, US 10,447,597 B1) in view of Miller et al. (hereinafter Miller, US 2021/0216625 A1) further in view of Duda et al. (hereinafter Duda, US 2012/0236723 A1) in view of Lindo (US 2016/0182322 A1).
Regarding Claim 16, Kim discloses A method comprising: configuring a processor to implement a control plane (Kim: col. 13 lines 39-50 “The control plane 112 includes one or more processors 792 (such as a microprocessor with multiple processing cores or units) that execute instructions and a memory 794 that stores instructions. These instructions can be specified by (1) a manufacturer of the network forwarding element that uses the forwarding IC 700, (2) a network administrator that deploys and maintains the network forwarding element, or (3) one or more automated processes that execute on servers and/or network forwarding elements that monitor network conditions. A processor 792, or another circuit of the control plane, communicates with the data plane through the control/data plane interface 765.” The control plane is implemented by a processor.);
configuring, by the control plane, a packet processing pipeline circuit in a data plane to process network packets (Kim: col. 5 line 30-45 “One of ordinary skill in the art will recognize that the term data message may be used herein to refer to various formatted collections of bits that may be sent across a network, such as Ethernet frames, IP packets” col. 13 lines 17-21 “In some embodiments, the control plane 112 configures the data processing circuits of the data plane to implement the PLT operator 130 and to perform message-forwarding operations through the data/control plane interface 765.”)
according to forwarding information provided by the control plane (Kim: col. 13 line 50-Col.14 line 8 “FIG. 8 illustrates an example of a match-action unit of some embodiments. As mentioned above, an ingress pipeline 740 or egress pipeline 742 in some embodiments has several MAU stages 732, each of which includes message-processing circuitry for forwarding received data messages and/or performing stateful operations based on these data messages. These operations are performed by processing values stored in the header vectors of the data messages. As shown in FIG. 8, the MAU 732 in some embodiments has a set of one or more match tables 805, a data plane stateful processing unit 810 (DSPU), a set of one or more stateful tables 815, an action crossbar 830, an action parameter memory 820, an action instruction memory 825, and an action arithmetic logic unit (ALU) 835. The match table set 805 can compare one or more fields in a received message's header vector (HV) to identify one or more matching flow entries (i.e., entries that match the message's HV). The match table set can include TCAM tables or exact match tables in some embodiments. In some embodiments, the match table set can be accessed at an address that is a value extracted from one or more fields of the message's header vector, or it can be a hash of this extracted value. In some embodiments, the local control plane or a remote controller supplies flow entries (e.g., the flow-match identifiers and/or action identifiers) to store in one or more match tables” col. 13 line 50-Col.14 line 8 “In some embodiments, the local control plane or a remote controller supplies flow entries (e.g., the flow-match identifiers and/or action identifiers) to store in one or more match tables” control plane provides flow match identifiers for forwarding to the data plane. the data plane comprises of match action units, as seen in Fig. 7 and col. 12 lines 34-58, and the match action units contains flow entries for its match tables, the forwarding information.);
providing, by the control plane, the forwarding information (Kim: col. 13 line 50-Col.14 line 8 “In some embodiments, the local control plane or a remote controller supplies flow entries (e.g., the flow-match identifiers and/or action identifiers) to store in one or more match tables” control plane provides flow match identifiers for forwarding to the data plane.);
processing, by the packet processing pipeline circuit, the network packets according to the forwarding information (Kim: col 14 lines 40-35 “The action ALU 835 also receives an instruction to execute from the action instruction memory 825. This memory 825 retrieves the instruction from its record that is identified by the address provided by the match table set 805. The action ALU 835 also receives the header vector for each message that the MAU processes. Such a header vector can also contain a portion or the entirety of an instruction to process and/or a parameter for processing the instruction. The action ALU 835 in some embodiments is a very large instruction word (VLIW) processor. The action ALU 835 executes instructions (from the instruction memory 835 or the header vector) based on parameters received on the action parameter bus 840 or contained in the header vector. The action ALU stores the output of its operation in the header vector in order to effectuate a message forwarding operation and/or stateful operation of its MAU stage 732. The output of the action ALU forms a modified header vector (HV′) for the next MAU stage.,” using the forwarding information from the match tables as established in col. 13 line 50 to col. 14 line 8, the packets are processed.);
configuring, by the control plane (Kim: col. 13 lines 17-30 “In some embodiments, the control plane 112 configures the data processing circuits of the data plane to implement the PLT operator 130 and to perform message-forwarding operations through the data/control plane interface 765. ”), the data plane to produce measurement values for a first network performance metric (Kim: col. 1 lines 52-col.2 line 8 “For a previously detected data message flow, the data plane PLT operator in some embodiments can also quickly detect whether the data message flow has changed the path that it has taken to the forwarding element (i.e., whether one or more forwarding elements have been added and/or removed to the set of prior forwarding elements traversed by the received data message). Also, for a previously detected data message flow, this data plane PLT operator in some embodiments can also quickly detect whether the hop latency has significantly changed at one or more forwarding elements along the flow's path…. After detecting a new data message flow, or detecting path or latency changes for a previously detected data message flow, the PLT operator of the last hop forwards to a control plane process of the last hop or of another device the path information (e.g., the forwarding element identifiers) and latency values (e.g., hop latency values of the forwarding elements along the path) that are embedded in the new data message's header. ” col. 5 line 10-15 “Similarly, in some embodiments, each particular forwarding element can sum the path latency values stored by previous forwarding elements in the message's header to compute an overall path latency value” the control plane configures the data plane to implement the PLT operator which detects network metrics of individual path latencies, and an overall path latency, the first and second metrics. Examiner notes that in para.00113 “A measurement calculator 1116 can receive lower level metrics (e.g., counts from the counters, times or elapsed time from the timers, etc.) and can calculate other metrics such as bandwidth and throughput.” this functionality if obtaining lower measurements to calculate a metric, therefore the act of obtaining latencies to obtain a final total latency reads on this limitation.);
producing, by the packet processing pipeline circuit, the measurement values for the first network performance metric in response to receiving the network packets (Kim: col. 1 line 44-52 “In some embodiments, the fast PLT operator in a forwarding element's data plane (1) detects a data message flow that is new for that forwarding element (e.g., a data message flow that is or appears to be a new data message flow for the forwarding element), (2) identifies the path (through the set of prior forwarding elements) traversed by the new data message flow to the forwarding element, and (3) identifies the latency that the data message flow is experiencing at each prior forwarding element on the path. The discussion below refers to each forwarding element traversed by a data message as a hop along the path.” As data message flow, comprising of network packets, traverses between the forwarded elements, such as in Fig. 1 path 120, the network metric such as latency is identified.)
using, by a measurement calculator in the data plane, the measurement values for the first network performance metric to produce the measurement values for a second network performance metric (Kim: col. 1 lines 52-col.2 line 8 “this data plane PLT operator in some embodiments can also quickly detect whether the hop latency has significantly changed at one or more forwarding elements along the flow's path…. After detecting a new data message flow, or detecting path or latency changes for a previously detected data message flow, the PLT operator of the last hop forwards to a control plane process of the last hop or of another device the path information (e.g., the forwarding element identifiers) and latency values (e.g., hop latency values of the forwarding elements along the path) that are embedded in the new data message's header.” col. 5 line 10-15 “Similarly, in some embodiments, each particular forwarding element can sum the path latency values stored by previous forwarding elements in the message's header to compute an overall path latency value” the control plane configures the data plane to implement the PLT operator which detects network metrics of individual path latencies, and an overall path latency, the first and second metrics. The instructions that calculates these values is the measurement calculator. Examiner notes that in para.00113 “A measurement calculator 1116 can receive lower level metrics (e.g., counts from the counters, times or elapsed time from the timers, etc.) and can calculate other metrics such as bandwidth and throughput.” this functionality if obtaining lower measurements to calculate a metric, therefore the act of obtaining latencies to obtain a final total latency reads on this limitation.)
reporting an anomaly in the measurement values for the second network performance metric in response to detecting the anomaly (Kim: col. 1 lines 52-col.2 line 8 “After detecting a new data message flow, or detecting path or latency changes for a previously detected data message flow, the PLT operator of the last hop forwards to a control plane process of the last hop or of another device the path information (e.g., the forwarding element identifiers) and latency values (e.g., hop latency values of the forwarding elements along the path) that are embedded in the new data message's header. ” col. 9 lines 1-15 “This approach allows the last hop's PLT operator to quickly determine whether the path or latency values have changed by comparing the overall path encoding value, latency encoding value, or combined path/latency encoding value with corresponding such values that the last hop's PLT operator previously stored as the current overall path encoding value, latency encoding value, or combined path/latency encoding value.” when changes to path or overall latency is detected, the second network performance metric, i.e. anomalous data, this is reported to the control plane.),
wherein the packet processing pipeline circuit is a hardware implemented pipeline circuit (Kim: col. 6 lines 50-55 “As further described below, the control plane 112 of a forwarding element is implemented by one or more general purpose central processing units (CPUs), while the data plane 110 of the forwarding element is implemented by application specific integrated circuit (ASIC) that is custom made to perform the data plane operations.” The data plane comprising of match action units in Fig. 7 and 8, is implemented in hardware circuitry in an ASIC or FPGA in col. 17 line 5-10.).
However Kim does not explicitly disclose a control plane that stores a plurality of network performance metric measurement policies for a plurality of network performance metrics; configuring the control plane and the packet processing pipeline circuit to use unsupervised machine learning to detect anomalous network traffic, wherein using unsupervised machine learning to detect the anomalous network traffic includes: configuring, by the control plane, the data plane to produce measurement values for a first network performance metric according to one of the network performance metric measurement policies; and storing the measurement values for the first network performance metric in a memory of the data plane; using, by a measurement calculator in the data plane, the measurement values for the first network performance metric to produce the measurement values for the second network performance metric according to a network performance metric policy that specifies a time period for periodically calculating the second network performance metric; and reporting an anomaly in the measurement values for the second network performance metric in response to an unsupervised machine learning algorithm using an unsupervised machine learning model to detect the anomaly
Miller discloses configuring the control plane and the packet processing pipeline circuit to use unsupervised machine learning to detect anomalous network traffic (Miller: para.0180 “The FPGA-accelerated servers and the GPU-accelerated servers described above may implement a model of computing where, rather than keeping a small amount of data in a CPU and running a long stream of instructions over it as occurred in more traditional computing models, the machine learning model and parameters are pinned into the high-bandwidth on-chip memory with lots of data streaming though the high-bandwidth on-chip memory. FPGAs may even be more efficient than GPUs for this computing model, as the FPGAs can be programmed with only the instructions needed to run this kind of computing model.” para.0410 “At operation 1902, a machine learning model is trained (e.g., by system 400 and/or any other system) to detect anomalies associated with read/write traffic processed by a storage system. The machine learning model may be supervised and/or unsupervised as may serve a particular implementation and may be configured to implement one or more decision tree learning algorithms, association rule learning algorithms, artificial neural network learning algorithms, deep learning algorithms, bitmap algorithms, and/or any other suitable data analysis technique as may serve a particular implementation. In some examples, the machine learning model is trained with actual ransomware payloads.” The instructions from the processor, control plane, and the actual performance of the instructions, the data plane, are designed to use Machine learning model, built into the FPGA or ASIC to detect anomalies in network traffic.):
wherein using unsupervised machine learning to detect the anomalous network traffic includes: reporting an anomaly in the measurement values for the second network performance metric in response to an unsupervised machine learning algorithm using an unsupervised machine learning model to detect the anomaly: (Miller: para.0338 “At decision 804, system 400 determines whether a total amount of read and write traffic exceeds a threshold. At decision 806, system 400 determines whether the write traffic is less compressible than the read traffic. If the total amount of read and write traffic exceeds the threshold (“Yes” at decision 804) and the write traffic is less compressible, or has a far high number of incompressible blocks than the read traffic, than the read traffic (“Yes” at decision 806), system 400 determines at operation 808 that the storage system is possibly being targeted by a security threat.” para.0413 “At operation 1906, system 400 determines, based on an output of the machine learning model, that the storage system is possibly being targeted by a security threat. This may be performed in any suitable manner.” para.0410 “The machine learning model may be supervised and/or unsupervised” para.0452 “In some examples, system 400 may notify the remote storage system of the security threat so that the remote storage system may abstain from deleting the recovery dataset until one or more conditions are fulfilled.” anomaly can be detected and reported using unsupervised machine learning algorithm).
Therefore, it would have been obvious to one ordinary skill in the art before the effective filing date of the claimed invention to combine Kim and Miller in order to incorporate configuring the control plane and the packet processing pipeline circuit to use unsupervised machine learning to detect anomalous network traffic, wherein using unsupervised machine learning to detect the anomalous network traffic includes: reporting an anomaly in the measurement values for the second performance metric in response to an unsupervised machine learning algorithm using an unsupervised machine learning model to detect the anomaly.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit that comes with the addition of AI and machine learning techniques, such as automated growth, correction and accuracy over time (Miller: para.0152-0154).
However Kim-Miller does not explicitly disclose a control plane that stores a plurality of network performance metric measurement policies for a plurality of network performance metrics; configuring, by the control plane, the data plane to produce measurement values for a first network performance metric according to one of the network performance metric measurement policies; and storing the measurement values for the first network performance metric in a memory of the data plane; using, by a measurement calculator in the data plane, the measurement values for the first network performance metric to produce the measurement values for the second network performance metric according to a network performance metric policy that specifies a time period for periodically calculating the second network performance metric.
Duda discloses a control plane that stores a network performance metric measurement policy for a plurality of network performance metrics (Duda: para.0022 “An important aspect of the present invention is that the queue length (or depth) is measured and recorded by the Queue Monitor at microsecond resolution or less. This allows the network switch to report latency and congestion conditions over extremely short time intervals. Specifically, this allows the detection and reporting of so-called microbursts, which are congestion conditions that only exist during very short time intervals and would not be detected if the packet queues were not monitored at microsecond resolution.” para.0027 “FIG. 4 is a flowchart illustrating a method to collect and analyze end-to-end latency of the network over time along a particular network path between the two ends (e.g., between two servers). In step 400, the central management system requests data from all interfaces of all switches along the path. In step 410, it receives the requested data from the switches, and in step 420 it stores the data. End-to-end latency is then calculated in step 430 by adding up the latency of each of the interfaces along the path at each time interval, resulting in very precise latency measurement for any path in the network.” The system is programmed such that for each time interval, latencies are collected and stored according to a particular time interval schedule for that metric, i.e. according to a network performance metric policy, therefore the control plane stores as least a single network performance metric measurement policy for these metrics of latency, queue length, congestion etc.);
configuring, by the control plane, the data plane to produce measurement values for a first network performance metric according to one of the network performance metric measurement policies (Duda: para.0022 “An important aspect of the present invention is that the queue length (or depth) is measured and recorded by the Queue Monitor at microsecond resolution or less. This allows the network switch to report latency and congestion conditions over extremely short time intervals. Specifically, this allows the detection and reporting of so-called microbursts, which are congestion conditions that only exist during very short time intervals and would not be detected if the packet queues were not monitored at microsecond resolution.” para.0027 “FIG. 4 is a flowchart illustrating a method to collect and analyze end-to-end latency of the network over time along a particular network path between the two ends (e.g., between two servers). In step 400, the central management system requests data from all interfaces of all switches along the path. In step 410, it receives the requested data from the switches, and in step 420 it stores the data. End-to-end latency is then calculated in step 430 by adding up the latency of each of the interfaces along the path at each time interval, resulting in very precise latency measurement for any path in the network.” The system is programmed such that for each time interval, latencies are collected and stored according to a particular time interval schedule for that metric, i.e. according to a network performance metric policy.);
storing the measurement values for the first network performance metric in a memory of the data plane (Duda: para.0027 “FIG. 4 is a flowchart illustrating a method to collect and analyze end-to-end latency of the network over time along a particular network path between the two ends (e.g., between two servers). In step 400, the central management system requests data from all interfaces of all switches along the path. In step 410, it receives the requested data from the switches, and in step 420 it stores the data.” The obtained metrics are stored at a storage of the central management system. Examiner notes that in view of para.0049-0050 of applicants specification “Recently developed network appliances, such as SmartNICs and certain switches and routers have data planes that rapidly process network traffic and have control planes that can control/configure the data plane and that can perform other tasks…. The data plane may also refer to components and/or operations that implement packet processing operations related to encryption, decryption, compression, decompression, firewalling, and telemetry. ” the control plane is controlling elements of the device, and the data plane is all other parts that are related to calculations, therefore the storage that holds the latency information is of the data plane.);
using the measurement values for the first network performance metric to produce the measurement values for a second network performance metric according to a network performance metric policy that specifies a time period for periodically calculating the second network performance metric (Duda: para.0022 “An important aspect of the present invention is that the queue length (or depth) is measured and recorded by the Queue Monitor at microsecond resolution or less. This allows the network switch to report latency and congestion conditions over extremely short time intervals. Specifically, this allows the detection and reporting of so-called microbursts, which are congestion conditions that only exist during very short time intervals and would not be detected if the packet queues were not monitored at microsecond resolution.” para.0027 “FIG. 4 is a flowchart illustrating a method to collect and analyze end-to-end latency of the network over time along a particular network path between the two ends (e.g., between two servers). In step 400, the central management system requests data from all interfaces of all switches along the path. In step 410, it receives the requested data from the switches, and in step 420 it stores the data. End-to-end latency is then calculated in step 430 by adding up the latency of each of the interfaces along the path at each time interval, resulting in very precise latency measurement for any path in the network.” The system is programmed such that for each time interval, latencies are collected and stored according to a particular time interval schedule for that metric, i.e. according to a network performance metric policy. These values are then used to calculate the network performance metric of end to end latency for each time interval.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Kim-Miller with that of Duda in order to incorporate a control plane that stores a network performance metric measurement policy for a plurality of network performance metrics; configuring, by the control plane, the data plane to produce measurement values for a first network performance metric according to one of the network performance metric measurement policies; storing the measurement values for the first network performance metric in a memory of the data plane; using the measurement values for the first network performance metric to produce the measurement values for a second network performance metric according to a network performance metric policy that specifies a time period for periodically calculating the second network performance metric, and apply this concept to the measurement calculator of Kim-Miller.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved latency measurements in the network (Duda: para.0027).
However Kim-Miller-Duda does not explicitly disclose a control plane that stores a plurality of network performance metric measurement policies for a plurality of network performance metrics
Lindo discloses a control plane that stores a plurality of network performance metric measurement policies for a plurality of network performance metrics (Lindo: para.0039 “The instrument encapsulation module 108 contains one or more metric reporting rules having one or more conditions that define one or more events which trigger reporting of operational metrics to the application analysis computer 150.” para.0040 “The instrument encapsulation module 108 uses the metric reporting rule(s) to selectively control the type(s) of operational metrics that are collected, how frequently the operational metrics are collected, and/or when the operational metrics are reported to the application analysis computer 150.” The encapsulation module 108 of the user terminal stores a plurality of metric reporting rules including what type of metric to collect and how frequently the metrics are collected).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Kim-Miller-Duda with Lindo in order to incorporate a control plane that stores a plurality of network performance metric measurement policies for a plurality of network performance metrics, and apply this concept to the control plane of Kim-Miller-Duda such that there are a plurality of rules for the metrics they collect.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of optimizing resource utilization by controlling what metrics are collected and how frequently using the rules (Lindo: para.0019).
Regarding Claim 18, Kim-Miller-Duda-Lindo discloses claim 16 as set forth above.
Kim further discloses the packet processing pipeline circuit includes match action units arranged as a hardware implemented match action pipeline (Kim: col. 6 lines 50-55 “As further described below, the control plane 112 of a forwarding element is implemented by one or more general purpose central processing units (CPUs), while the data plane 110 of the forwarding element is implemented by application specific integrated circuit (ASIC) that is custom made to perform the data plane operations.” col. 12 lines 34-58 “As shown, the data plane 110 includes multiple message-processing pipelines, including multiple ingress pipelines 740 and egress pipelines 742. The data plane 110 also includes a traffic manager 744 that is placed between the ingress and egress pipelines 740 and 742. The traffic manager 744 serves as a crossbar switch that directs messages between different ingress and egress pipelines. Each ingress/egress pipeline includes a parser 730, several MAU stages 732, and a deparser 734.” col. 13 line 50-Col.14 line 8 “FIG. 8 illustrates an example of a match-action unit of some embodiments. As mentioned above, an ingress pipeline 740 or egress pipeline 742 in some embodiments has several MAU stages 732, each of which includes message-processing circuitry for forwarding received data messages and/or performing stateful operations based on these data messages.” The data plane comprising of match action units in Fig. 7 and 8, is implemented in hardware circuitry in an ASIC or FPGA in col. 17 line 5-10.); and
the control plane configures at least one of the match action units to produce the measurement values for the first network performance metric (Kim: col. 13 lines 17-30 “In some embodiments, the control plane 112 configures the data processing circuits of the data plane to implement the PLT operator 130 and to perform message-forwarding operations through the data/control plane interface 765. ” col. 1 lines 52-col.2 line 8 “For a previously detected data message flow, the data plane PLT operator in some embodiments can also quickly detect whether the data message flow has changed the path that it has taken to the forwarding element (i.e., whether one or more forwarding elements have been added and/or removed to the set of prior forwarding elements traversed by the received data message). Also, for a previously detected data message flow, this data plane PLT operator in some embodiments can also quickly detect whether the hop latency has significantly changed at one or more forwarding elements along the flow's path…. After detecting a new data message flow, or detecting path or latency changes for a previously detected data message flow, the PLT operator of the last hop forwards to a control plane process of the last hop or of another device the path information (e.g., the forwarding element identifiers) and latency values (e.g., hop latency values of the forwarding elements along the path) that are embedded in the new data message's header. ” the control plane configures the data plane to implement the PLT operator which detects network metrics. ).
Regarding Claim 19, Kim discloses A system (Kim: Fig. 1 and 7) comprising:
a network traffic processing means for providing networking services to workloads (Kim: Fig. 9 col. 15 line 46-59 “The electronic system 900 may be a computer (e.g., a desktop computer, personal computer, tablet computer, server computer, mainframe, a blade computer etc.), or any other sort of electronic device.”) by processing network packets (Kim: col 14 lines 40-35 “The action ALU 835 also receives an instruction to execute from the action instruction memory 825. This memory 825 retrieves the instruction from its record that is identified by the address provided by the match table set 805. The action ALU 835 also receives the header vector for each message that the MAU processes. Such a header vector can also contain a portion or the entirety of an instruction to process and/or a parameter for processing the instruction. The action ALU 835 in some embodiments is a very large instruction word (VLIW) processor. The action ALU 835 executes instructions (from the instruction memory 835 or the header vector) based on parameters received on the action parameter bus 840 or contained in the header vector. The action ALU stores the output of its operation in the header vector in order to effectuate a message forwarding operation and/or stateful operation of its MAU stage 732. The output of the action ALU forms a modified header vector (HV′) for the next MAU stage.,” using the forwarding information from the match tables as established in col. 13 line 50 to col. 14 line 8, the packets are processed by the MAUs in the data plane. Fig. 7-8.)
according to forwarding information provided by a configuration means for configuring the network traffic processing means (Kim: col. 13 line 50-Col.14 line 8 “In some embodiments, the local control plane or a remote controller supplies flow entries (e.g., the flow-match identifiers and/or action identifiers) to store in one or more match tables” control plane provides flow match identifiers for forwarding to the data plane.);
a measurement means for producing measurement values for a network performance metric (Kim: col. 1 line 44-52 “In some embodiments, the fast PLT operator in a forwarding element's data plane (1) detects a data message flow that is new for that forwarding element (e.g., a data message flow that is or appears to be a new data message flow for the forwarding element), (2) identifies the path (through the set of prior forwarding elements) traversed by the new data message flow to the forwarding element, and (3) identifies the latency that the data message flow is experiencing at each prior forwarding element on the path. The discussion below refers to each forwarding element traversed by a data message as a hop along the path.” As data message flow, comprising of network packets, traverses between the forwarded elements, such as in Fig. 1 path 120, the network metric such as latency is identified.);
an anomaly detection means for detecting anomalous network traffic to or from the workloads by detecting an anomaly in the measurement values (Kim: col. 1 lines 52-col.2 line 8 “After detecting a new data message flow, or detecting path or latency changes for a previously detected data message flow, the PLT operator of the last hop forwards to a control plane process of the last hop or of another device the path information (e.g., the forwarding element identifiers) and latency values (e.g., hop latency values of the forwarding elements along the path) that are embedded in the new data message's header. ” when changes to path or latency is detected, i.e. anomalous data, this is reported to the control plane.); and
a reporting means for reporting the anomaly (Kim: col. 1 lines 52-col.2 line 8 “After detecting a new data message flow, or detecting path or latency changes for a previously detected data message flow, the PLT operator of the last hop forwards to a control plane process of the last hop or of another device the path information (e.g., the forwarding element identifiers) and latency values (e.g., hop latency values of the forwarding elements along the path) that are embedded in the new data message's header. ” when changes to path or latency is detected, i.e. anomalous data, this is reported to the control plane.),
wherein: a hardware implemented circuit including a specialized set of elements (Kim: col. 6 lines 50-55 “As further described below, the control plane 112 of a forwarding element is implemented by one or more general purpose central processing units (CPUs), while the data plane 110 of the forwarding element is implemented by application specific integrated circuit (ASIC) that is custom made to perform the data plane operations.” The data plane comprising of match action units in Fig. 7 and 8, is implemented in hardware circuitry in an ASIC or FPGA in col. 17 line 5-10.)
configured as the measurement means and as the network traffic processing means such that at least one of the specialized set of elements concurrently performs packet processing and measurement production (Kim: col. 13 line 50-Col.14 line 8 “FIG. 8 illustrates an example of a match-action unit of some embodiments. As mentioned above, an ingress pipeline 740 or egress pipeline 742 in some embodiments has several MAU stages 732, each of which includes message-processing circuitry for forwarding received data messages and/or performing stateful operations based on these data messages. These operations are performed by processing values stored in the header vectors of the data messages.” Col. 13 line 5-38“In some embodiments, the control plane 112 configures the data processing circuits of the data plane to implement the PLT operator 130 and to perform message-forwarding operations through the data/control plane interface 765. In some embodiments, multiple MAU stages are needed to implement the PLT operator. In these embodiments, earlier MAU stages write their outputs to the processed header vectors in order to make these outputs available for subsequent MAU stages that also implement the PLT operator. ” col. 1 lines 52-col.2 line 8 “this data plane PLT operator in some embodiments can also quickly detect whether the hop latency has significantly changed at one or more forwarding elements along the flow's path…. After detecting a new data message flow, or detecting path or latency changes for a previously detected data message flow, the PLT operator of the last hop forwards to a control plane process of the last hop or of another device the path information (e.g., the forwarding element identifiers) and latency values (e.g., hop latency values of the forwarding elements along the path) that are embedded in the new data message's header. ” Each MAU is configured to forward the messages, and further implement the PLT operator that produces measurement values.);
the anomaly indicates anomalous network traffic to or from the workloads (Kim: col. 1 line 44-52 “In some embodiments, the fast PLT operator in a forwarding element's data plane (1) detects a data message flow that is new for that forwarding element (e.g., a data message flow that is or appears to be a new data message flow for the forwarding element), (2) identifies the path (through the set of prior forwarding elements) traversed by the new data message flow to the forwarding element, and (3) identifies the latency that the data message flow is experiencing at each prior forwarding element on the path. The discussion below refers to each forwarding element traversed by a data message as a hop along the path.” col. 1 lines 52-col.2 line 8 “After detecting a new data message flow, or detecting path or latency changes for a previously detected data message flow, the PLT operator of the last hop forwards to a control plane process of the last hop or of another device the path information (e.g., the forwarding element identifiers) and latency values (e.g., hop latency values of the forwarding elements along the path) that are embedded in the new data message's header.” when changes to path or latency is detected, i.e. anomalous data, this is reported to the control plane for messages going from the first device to the second device for a particular flow.).
However Kim does not explicitly disclose a network performance metric measurement policy storage means for storing network performance metric measurement policies; a periodic measurement means for producing measurement values for a network performance metric according to one of the network performance metric measurement policies that specifies a time period for periodically calculating the network performance metric; a specialized set of elements is configured as the periodic measurement means; the anomaly detection means includes an unsupervised machine learning algorithm that uses an unsupervised machine learning model to detect the anomaly.
Miller discloses the anomaly detection means includes an unsupervised machine learning algorithm that uses an unsupervised machine learning model to detect the anomaly (Miller: para.0180 “The FPGA-accelerated servers and the GPU-accelerated servers described above may implement a model of computing where, rather than keeping a small amount of data in a CPU and running a long stream of instructions over it as occurred in more traditional computing models, the machine learning model and parameters are pinned into the high-bandwidth on-chip memory with lots of data streaming though the high-bandwidth on-chip memory. FPGAs may even be more efficient than GPUs for this computing model, as the FPGAs can be programmed with only the instructions needed to run this kind of computing model.” para.0410 “At operation 1902, a machine learning model is trained (e.g., by system 400 and/or any other system) to detect anomalies associated with read/write traffic processed by a storage system. The machine learning model may be supervised and/or unsupervised as may serve a particular implementation and may be configured to implement one or more decision tree learning algorithms, association rule learning algorithms, artificial neural network learning algorithms, deep learning algorithms, bitmap algorithms, and/or any other suitable data analysis technique as may serve a particular implementation. In some examples, the machine learning model is trained with actual ransomware payloads.” The instructions from the processor, control plane, and the actual performance of the instructions, the data plane, are designed to use Machine learning model, built into the FPGA or ASIC to detect anomalies in network traffic.).
Therefore, it would have been obvious to one ordinary skill in the art before the effective filing date of the claimed invention to combine Kim and Miller in order to incorporate the anomaly detection means includes an unsupervised machine learning algorithm that uses an unsupervised machine learning model to detect the anomaly.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit that comes with the addition of AI and machine learning techniques, such as automated growth, correction and accuracy over time (Miller: para.0152-0154).
However Kim-Miller does not explicitly disclose a network performance metric measurement policy storage means for storing network performance metric measurement policies; a periodic measurement means for producing measurement values for a network performance metric according to one of the network performance metric policies that specifies a time period for periodically calculating the network performance metric; a specialized set of elements is configured as the periodic measurement means.
Duda discloses a network performance metric measurement policy storage means for storing a network performance metric measurement policy (Duda: para.0022 “An important aspect of the present invention is that the queue length (or depth) is measured and recorded by the Queue Monitor at microsecond resolution or less. This allows the network switch to report latency and congestion conditions over extremely short time intervals. Specifically, this allows the detection and reporting of so-called microbursts, which are congestion conditions that only exist during very short time intervals and would not be detected if the packet queues were not monitored at microsecond resolution.” para.0027 “FIG. 4 is a flowchart illustrating a method to collect and analyze end-to-end latency of the network over time along a particular network path between the two ends (e.g., between two servers). In step 400, the central management system requests data from all interfaces of all switches along the path. In step 410, it receives the requested data from the switches, and in step 420 it stores the data. End-to-end latency is then calculated in step 430 by adding up the latency of each of the interfaces along the path at each time interval, resulting in very precise latency measurement for any path in the network.” The system is programmed such that for each time interval, latencies are collected and stored according to a particular time interval schedule for that metric, i.e. according to a network performance metric policy, therefore the control plane stores as least a single network performance metric measurement policy for these metrics of latency, queue length, congestion etc.)
a periodic measurement means for producing measurement values for a network performance metric according to one of the network performance metric policies that specifies a time period for periodically calculating the network performance metric (Duda: para.0022 “An important aspect of the present invention is that the queue length (or depth) is measured and recorded by the Queue Monitor at microsecond resolution or less. This allows the network switch to report latency and congestion conditions over extremely short time intervals. Specifically, this allows the detection and reporting of so-called microbursts, which are congestion conditions that only exist during very short time intervals and would not be detected if the packet queues were not monitored at microsecond resolution.” para.0027 “FIG. 4 is a flowchart illustrating a method to collect and analyze end-to-end latency of the network over time along a particular network path between the two ends (e.g., between two servers). In step 400, the central management system requests data from all interfaces of all switches along the path. In step 410, it receives the requested data from the switches, and in step 420 it stores the data. End-to-end latency is then calculated in step 430 by adding up the latency of each of the interfaces along the path at each time interval, resulting in very precise latency measurement for any path in the network.” The system is programmed such that for each time interval, latencies are collected and stored according to a particular time interval schedule for that metric, i.e. according to a network performance metric policy. These values are then used to calculate the network performance metric of end to end latency for each time interval.);
a specialized set of elements is configured as the periodic measurement means (Duda: para.0022 “An important aspect of the present invention is that the queue length (or depth) is measured and recorded by the Queue Monitor at microsecond resolution or less. This allows the network switch to report latency and congestion conditions over extremely short time intervals. Specifically, this allows the detection and reporting of so-called microbursts, which are congestion conditions that only exist during very short time intervals and would not be detected if the packet queues were not monitored at microsecond resolution.” para.0027 “FIG. 4 is a flowchart illustrating a method to collect and analyze end-to-end latency of the network over time along a particular network path between the two ends (e.g., between two servers). In step 400, the central management system requests data from all interfaces of all switches along the path. In step 410, it receives the requested data from the switches, and in step 420 it stores the data. End-to-end latency is then calculated in step 430 by adding up the latency of each of the interfaces along the path at each time interval, resulting in very precise latency measurement for any path in the network.” The instructions that are configured to obtain latency information at each time interval).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Kim-Miller with Duda in order to incorporate a network performance metric measurement policy storage means for storing a network performance metric measurement policy; a periodic measurement means for producing measurement values for a network performance metric according to one of the network performance metric policies that specifies a time period for periodically calculating the network performance metric; a specialized set of elements is configured as the periodic measurement means.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved latency measurements in the network (Duda: para.0027).
However Kim-Miller-Duda does not explicitly disclose a network performance metric measurement policy storage means for storing network performance metric measurement policies.
Lindo discloses a network performance metric measurement policy storage means for storing network performance metric measurement policies (Lindo: para.0039 “The instrument encapsulation module 108 contains one or more metric reporting rules having one or more conditions that define one or more events which trigger reporting of operational metrics to the application analysis computer 150.” para.0040 “The instrument encapsulation module 108 uses the metric reporting rule(s) to selectively control the type(s) of operational metrics that are collected, how frequently the operational metrics are collected, and/or when the operational metrics are reported to the application analysis computer 150.” The encapsulation module 108 of the user terminal stores a plurality of metric reporting rules including what type of metric to collect and how frequently the metrics are collected).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Kim-Miller-Duda with Lindo in order to incorporate a network performance metric measurement policy storage means for storing network performance metric measurement policies, and apply this concept to the control plane of Kim-Miller-Duda such that there are a plurality of rules for the metrics they collect.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of optimizing resource utilization by controlling what metrics are collected and how frequently using the rules (Lindo: para.0019).
Regarding Claim 21, Kim-Miller-Duda-Lindo disclose claim 1 as set forth above.
Kim further discloses wherein: each of the match action units is configurable to process the network packets according to the forwarding information (Kim: col. 13 lines 17-30 “In some embodiments, the control plane 112 configures the data processing circuits of the data plane to implement the PLT operator 130 and to perform message-forwarding operations through the data/control plane interface 765. ” col. 13 line 50-Col.14 line 8 “In some embodiments, the local control plane or a remote controller supplies flow entries (e.g., the flow-match identifiers and/or action identifiers) to store in one or more match tables” control plane provides flow match identifiers for forwarding to the match tables of the match action units of a data plane.); and
each of the match action units is configurable to produce the measurement values for the network performance metric (Kim: col. 13 lines 17-30 “In some embodiments, the control plane 112 configures the data processing circuits of the data plane to implement the PLT operator 130 and to perform message-forwarding operations through the data/control plane interface 765. ” col. 1 lines 52-col.2 line 8 “For a previously detected data message flow, the data plane PLT operator in some embodiments can also quickly detect whether the data message flow has changed the path that it has taken to the forwarding element (i.e., whether one or more forwarding elements have been added and/or removed to the set of prior forwarding elements traversed by the received data message). Also, for a previously detected data message flow, this data plane PLT operator in some embodiments can also quickly detect whether the hop latency has significantly changed at one or more forwarding elements along the flow's path…. After detecting a new data message flow, or detecting path or latency changes for a previously detected data message flow, the PLT operator of the last hop forwards to a control plane process of the last hop or of another device the path information (e.g., the forwarding element identifiers) and latency values (e.g., hop latency values of the forwarding elements along the path) that are embedded in the new data message's header. ” the control plane configures the data plane to implement the PLT operator which detects network metrics. ).
Claim(s) 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Kim et al. (hereinafter Kim, US 10,447,597 B1) in view of Miller et al. (hereinafter Miller, US 2021/0216625 A1) further in view of Duda et al. (hereinafter Duda, US 2012/0236723 A1) in view of Lindo (US 2016/0182322 A1) in view of Vasseur et al. (hereinafter Vasseur, US 2020/0351173 A1).
Regarding Claim 17, Kim-Miller-Duda-Lindo discloses claim 16 as set forth above.
Kim further discloses the edge nodes includes a hardware implemented packet processing pipeline circuit (Kim: Col .5 lines 58-Col. 6 line 8, “As shown, each hardware forwarding element 102-108 has (1) a set of data plane circuits 110 (the data plane 110) for forwarding data messages received along the data path to their destinations,” col. 12 lines 34-58 “As shown, the data plane 110 includes multiple message-processing pipelines, including multiple ingress pipelines 740 and egress pipelines 742. The data plane 110 also includes a traffic manager 744 that is placed between the ingress and egress pipelines 740 and 742. The traffic manager 744 serves as a crossbar switch that directs messages between different ingress and egress pipelines. Each ingress/egress pipeline includes a parser 730, several MAU stages 732, and a deparser 734.” seen in Fig. 1 for each forwarding element, but in more detail in Fig. 7. Fig. 7 110 shows a data plane with a plurality of MAUs, match action units, arranged in a pipeline. The data plane is implemented as an ASIC as in col. 6 lines 50-55 above, and therefore the MAU pipeline is hardware implemented.)
However while Kim-Miller discloses the usage of unsupervised Machine learning techniques (Miller: para.0410 “The machine learning model may be supervised and/or unsupervised”), it does not explicitly disclose receiving, by a central training node, initial measurement values from a plurality of edge nodes, wherein each of the edge nodes includes a hardware implemented packet processing pipeline circuit; producing, by the central training node, the unsupervised machine learning model from the initial measurement values; and deploying, by the central training node, the unsupervised machine learning model to the edge nodes for local anomaly detection.
Vasseur discloses receiving, by a central training node, initial measurement values from a plurality of edge nodes (Vasseur: para.0039 “Supervisory service 310 may be in communication with any number of devices 308 (e.g., a first through n.sup.th device), which may be CE routers 110 and/or PE routers 120, described previously, or other forms of networking devices configured to convey traffic through the network.” Para.0076 “The procedure 600 my start at step 605 and continue on to step 610 where, as described in greater detail above, the supervisory service may receive telemetry data samples from a plurality of networking devices in the one or more networks. “ telemetry, i.e. initial measurement values, are received from a plurality of edge devices.),
producing, by the central training node, the unsupervised machine learning model from the initial measurement values (Vasseur: para.0077 “At step 615, as detailed above, the supervisory service may train a failure prediction model to predict failures in the one or more networks, using a training dataset comprising the received telemetry data samples.” Para.0033 “ In various embodiments, predictive routing process 248 may employ one or more supervised, unsupervised, or semi-supervised machine learning models.” An unsupervised model is trained using the set of telemetry collected.); and
deploying, by the central training node, the unsupervised machine learning model to the edge nodes for local anomaly detection (Vasseur: para.0060 “FIG. 4C illustrates an alternate implementation 410 in which supervisory service 310 pushes the failure prediction model to device 308 for local/on-premise inference.” The trained model is deployed to the devices 308 that the telemetry was collected from.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Kim-Miller-Duda with that of Vasseur in order to incorporate receiving, by a central training node, initial measurement values from a plurality of edge nodes, producing, by the central training node, the unsupervised machine learning model from the initial measurement values; and deploying, by the central training node, the unsupervised machine learning model to the edge nodes for local anomaly detection, and apply this concept to the edge nodes that have a hardware implemented packet processing pipeline circuit, such that telemetry from a plurality of edge devices with a hardware implemented packet processing pipeline circuit may be used to train the unsupervised machine learning model.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved network performance monitoring (Vasseur: abstract, para.0001-0004).
Claim(s) 20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Kim et al. (hereinafter Kim, US 10,447,597 B1) in view of Miller et al. (hereinafter Miller, US 2021/0216625 A1) further in view of Duda et al. (hereinafter Duda, US 2012/0236723 A1) in view of Lindo (US 2016/0182322 A1) in view of Maha (US 2021/0281590 A1).
Regarding Claim 20, Kim-Miller-Duda-Lindo discloses claim 19 as set forth above.
Kim discloses detecting the anomalous network traffic to or from the workloads (Kim: col. 1 line 44-52 “In some embodiments, the fast PLT operator in a forwarding element's data plane (1) detects a data message flow that is new for that forwarding element (e.g., a data message flow that is or appears to be a new data message flow for the forwarding element), (2) identifies the path (through the set of prior forwarding elements) traversed by the new data message flow to the forwarding element, and (3) identifies the latency that the data message flow is experiencing at each prior forwarding element on the path. The discussion below refers to each forwarding element traversed by a data message as a hop along the path.” col. 1 lines 52-col.2 line 8 “After detecting a new data message flow, or detecting path or latency changes for a previously detected data message flow, the PLT operator of the last hop forwards to a control plane process of the last hop or of another device the path information (e.g., the forwarding element identifiers) and latency values (e.g., hop latency values of the forwarding elements along the path) that are embedded in the new data message's header.” when changes to path or latency is detected, i.e. anomalous data, this is reported to the control plane for messages going from the first device to the second device for a particular flow.).
However Kim-Miller-Duda-Lindo does not explicitly disclose a network configuration means for updating a network configuration from a first network configuration to a second network configuration; and a rollback triggering means for triggering a configuration rollback means
Maha discloses a network configuration means for updating a network configuration from a first network configuration to a second network configuration (Maha: para.0084 “In block 536, if a local or global anomaly is detected or alerted, then the mobile device may perform some remedial action. For example, the remedial action could include notifying a local user, notifying an enterprise security administrator, uninstalling a suspect application, sandboxing a suspect application, disabling a suspect application, rolling back an operating system update, rolling back an application update, or taking some other appropriate remedial action.” device 200, such as in Fig. 2 has OS updates and application updates, both of which are network configuration updates from one configuration to another); and
a rollback triggering means for triggering a configuration rollback means to roll back the network configuration from the second network configuration to the first network configuration (Maha: para.0084 “In block 536, if a local or global anomaly is detected or alerted, then the mobile device may perform some remedial action. For example, the remedial action could include notifying a local user, notifying an enterprise security administrator, uninstalling a suspect application, sandboxing a suspect application, disabling a suspect application, rolling back an operating system update, rolling back an application update, or taking some other appropriate remedial action.” upon detection, these updates are rolled back, thereby going from the second configuration back to the first.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Kim-Miller-Duda-Lindo with Maha in order to incorporate a network configuration means for updating a network configuration from a first network configuration to a second network configuration; and a rollback triggering means for triggering a configuration rollback means
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of solving the anomaly (Maha: para.0084).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Zhu et al. US 2020/0090002 A1, see Fig. 4 and parra.0043 describing a federated training for models, using local data.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to EUI H KIM whose telephone number is (571)272-8133. The examiner can normally be reached 7:30-5 M-R, M-F alternating.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kamal B Divecha can be reached on 5712725863. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/EUI H KIM/Examiner, Art Unit 2453
/KAMAL B DIVECHA/Supervisory Patent Examiner, Art Unit 2453
Prosecution Insights