Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Remarks
This Office Action is responsive to Applicants' Amendment filed on 02/23/2026, in which claims 1, 2, 5, 8, 10, 12-15, and 18 are amended. No claims are newly cancelled or added.
Claims 1-19 are currently pending.
Response to Arguments
With regards to the objections to claims 1, 2, and 14, for minor informalities, Examiner agrees that the claims as amended no longer recite the previously noted informalities. However, Examiner notes that claims 1 and 14 are objected to due to a new informality introduced by the amendments to the claims.
With regards to the rejections of claims 1-19 under 35 U.S.C. 112(b) under varying rationales, Examiner partially agrees with Applicant’s assertion that the amendments to the claims overcome the rejections. The previously noted causes of indefiniteness for claims 1-19 have been resolved with the amendments to the claims, however, Examiner notes that due to the amendments, several new causes of indefiniteness have been introduced for claims 1-13 and 15, resulting in rejections under 35 U.S.C. 112(b) under new bases. Additionally, Examiner notes that the amendments to claims 8, 10, 14, and 18 to overcome the 112(b) rejections recite new matter, and have thus resulted in new rejections of the claims and their dependents under 35 U.S.C. 112(a).
With regards to the rejections of claim 1-19 under 35 U.S.C. 103 under various combinations of prior art, Applicant first argues against the combination of Xu and Gyllenhammar to teach independent claims 1 and 14. Examiner finds Applicant’s argument on page 16 of the Remarks that “Second, there is no setting of multiple threshold values (latent, reconstruction, and each hidden layer) in both both Xu and Gyllenhammar” persuasive, however the arguments are moot in view of a new grounds of rejection that is necessitated by Applicant’s amendments to the claims that added additional thresholds, as presented below.
Additionally in regards to claims 1 and 14, Applicant makes several arguments against the rejection that Examiner does not find persuasive. On page 15 and 16 of the Remarks, Applicant argues “First, there is no ‘extracting hierarchical information of the trained autoencoder’ in both Xu and Gyllenhammar. Claim 1 explicitly requires ‘extracting hierarchical information of the trained autoencoder’. Xu’s disclosure of encoding input features into a latent space is not an explicit extraction of hierarchical information from the trained model”. Examiner notes that “hierarchical information” is not well-known terminology within the art with a specific technical meaning, and therefore the broadest reasonable interpretation of the term in light of the specification is taken.
The specification states at [0094] “Next, the hierarchical network intrusion detection system 100 according to an embodiment of the present disclosure extracts learned hierarchical information of the autoencoder (S240)”, and at [0095] “For example, the hierarchical network intrusion detection system 100 may extract hierarchical information including an input dataset, a reconstruction dataset, the number of hidden layers of an encoder and a decoder, latent vector of an encoder for input data, output values of L hidden layers included in an encoder for input data, a reconstruction error of each of L hidden layers of an encoder for input data, and a reconstruction error of each of L hidden layers included in an encoder for normal data for training”. Xu’s extraction of features of network traffic, which are then reduced into the latent space, during training corresponds to an input dataset at the very least, and additionally discloses creation of a latent vector and output of the encoder. Xu also describes computing reconstruction error, as mapped to other limitations of claim 1. Therefore, under the broadest reasonable interpretation of the term, Xu extracts hierarchical information from the autoencoder that it trains.
Applicant further argues against the rejections of claims 1 and 14 on pages 16 and 17 of the Remarks that “Third, there is no calculating of anomaly scores at multiple levels in both Xu and Gyllenhammar”, as well as “The references provide no teaching or motivation for calculating separate anomaly scores for the latent representation and for each hidden layer's output” and “In sum, nothing in Xu or Gyllenhammar suggests generating multiple anomaly scores at different layers of the autoencoder”. However, the language of the relevant limitation is: calculating anomaly scores of a latent vector for a target network data, the reconstruction data for the target network data, and an output value of each of the L hidden layers included in the encoder, in a state in which the target network data is input to the autoencoder;. There is no explicit calculation of anomaly scores at separate levels, separate anomaly scores, or anomaly scores at separate layers.
The broadest reasonable interpretation of the language of the limitation is that multiple anomaly scores are calculated, and that they are based on a latent vector and reconstruction data of target network data, as well as the output of hidden layers of the encoder when target network data is input. The anomaly scores of Xu qualify here, as mapped in the rejection below, due to being based on the reconstructed data from the latent space, the reconstruction error, and the output of the “bottleneck” layer of the autoencoder, which takes the output of the hidden layers of the encoder as input, all of which with target network data as the input to the autoencoder (during training).
Applicant further argues against the rejections of claims 1 and 14 on page 17 of the Remarks that “Fourth, there is no multi-score, multi-threshold intrusion decision in both Xu and Gyllenhammar”. Examiner acknowledges the lack of multiple thresholds in the combination of Xu and Gyllenhammar, however these were newly added in the amendment and are taught by the combination of art in the new rejection.
Applicant further argues against the combination of Xu, Gyllenhammar, and Nguimbous to teach claims 5 and 15. Applicant argues on page 19 of the Remarks that “Nguimbous itself does not disclose the claim's multi-layer approach to threshold setting” and “Nguimbous teaches a single optimized threshold, not per-layer thresholds”. However, Examiner notes that claims 5 and 15 only recite a single threshold value, “the threshold value”. Examiner respectfully asserts that per-layer thresholds are not recited in claims 5 and 15, rather a single threshold is set which minimizes a fall-out rate for earlier layers and maximizes a detection rate for an L-th layer. Examiner respectfully asserts that the single threshold of Nguimbous that is dually-optimized to minimize false positive rate first and then false negative rate second provides similar functionality to the threshold described in claims 5 and 15.
Applicant further argues on page 19 of the Remarks with regards to the combination of Xu, Gyllenhammar, and Nguimbous for claims 5 and 15, that “Further, there is no suggestion of hierarchical ‘staged’ anomaly filtering in Nguimbous. Claim 5's language implies a hierarchical anomaly detection process: earlier layers operate with thresholds tuned to be very strict (few false positives), and only if data passes those layers (i.e., is not flagged as anomalous) does it get evaluated at the final layer, which uses a high-sensitivity threshold to catch any remaining anomalies. This is a unique approach to balancing false alarms and missed detections across layers. Nguimbous does not teach or foresee this stage-wise application of thresholds”. Examiner again respectfully asserts that only a single threshold is recited in claims 5 and 15, meaning that thresholds for earlier layers cannot be tuned differently than a threshold for a final layer because there is only one threshold to be tuned for all layers. Examiner also notes that MPEP 2111 states the following from In re Prater: “The court agreed that the claim was not limited to using a machine to carry out the process since the claim did not explicitly set forth the machine. The court explained that ‘reading a claim in light of the specification, to thereby interpret limitations explicitly recited in the claim, is a quite different thing from ‘reading limitations of the specification into a claim,’ to thereby narrow the scope of the claim by implicitly adding disclosed limitations which have no express basis in the claim.’ The court found that applicant was advocating the latter, i.e., the impermissible importation of subject matter from the specification into the claim”. That is, that the broadest reasonable interpretation of claim limitations does not necessarily include any implicit elements from the Specification.
Applicant further argues against the combination of Xu, Gyllenhammar, and Mortensen to teach claims 6 and 16. Applicant argues on page 21 of the Remarks that “Mortensen is focused on fault detection in mobile robotics using autoencoders, not network intrusion detection. Mortensen’s use of Mahalanobis distance is specifically to measure how a new sample's reconstruction error vector deviates from the distribution of normal reconstruction errors (to better judge anomaly scores). Claim 6, however, calls for computing an anomaly score of the latent vector itself using Mahalanobis distance (comparing the latent vector to a distribution of training latent vectors). This is a non-trivial adaptation”. However, Examiner notes that the formula used by Mortensen matches the formula recited in claims 6 and 16, including being calculated from the vectors of a given sample. Mortensen also states: (Mortensen Pg. 10) “For a formal definition of an Autoencoder, we can consider the function fθ(x) = h as the encoder mapping the input x = {x1, x2, ..., xn} into a feature vector h = {h1, h2, ..., hk}, i.e. the LSR”, with LSR standing for “Latent Space Representation”. Therefore, Mortensen discloses both a latent vector from an encoder and Mahalanobis distance for vectors, and substituting a latent vector for a reconstructed vector can be done trivially and with minimal experimentation.
Applicant further argues on page 21 of the Remarks that “Further, Xu already uses a straightforward threshold on reconstruction error to detect anomalies. There is no suggestion in Xu that this approach was inadequate or that a more complex statistical distance (like Mahalanobis) should be applied to latent features. Mortensen's rationale for Mahalanobis was to handle correlated features in robot sensor data, which is a different context. One of ordinary skill in network intrusion detection would have no obvious reason to incorporate Mortensen's latent-space anomaly scoring into Xu's system, absent the insight from Applicant's invention”. Examiner notes that it is uncommon for inventors and authors to explicitly describe shortcomings of their approaches in publications.
Additionally, while Xu does not describe inadequacies with a threshold on reconstruction error, Mortensen describes: (Mortensen Pg. 12) “In cases where the variables are uncorrelated the Euclidean distance may be a useful metric to find outliers. However, in cases where some correlation between the variables can be observed it will not provide useful information in terms of the distance to the cluster, as can be seen in Figure 3a. The Mahalanobis distance which is defined in Equation 7 is a measure better suited for multivariate data with correlations as it considers the distribution of the points, which is done by incorporating the covariance matrix [25]. Figure 3b shows how the Mahalanobis distance provides a better estimate of the anomalousness of a sample, as points which are further away from the cluster are scored higher than those closer to it”. Because Xu uses simple distance of a reconstruction error from a threshold, it is using Euclidean distance, while Mortensen discloses how Mahalanobis distance is better for distinguishing anomalous samples from normal samples, since normal samples exhibit clustering behavior. Although the application of both works is different, as Xu is in the field of network traffic and Mortensen is in the field of robotic sensors, both use autoencoders to detect anomalous data points, and so techniques used for this purpose, such as Mahalanobis distance, are obvious to consider in both cases.
Claim Objections
Claims 1 and 14 objected to because of the following informality: anomaly scores of a latent vector for a target network data should read “anomaly scores of a latent vector for target network data”. Appropriate correction is required.
Claim Rejections - 35 USC § 112(a)
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 8-11 and 14-19 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claims contain subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Regarding claim 8,
Claim 8, as amended, recites the limitations where, µ0 is an average of reconstruction errors corresponding to error values between input data for normal dataset for training and the reconstruction data and U0 is a left singular vector obtained by performing a singular value decomposition calculation. Neither variable “µ0” nor “U0” is defined in the original disclosure, and neither is a “left singular vector” recited. Therefore the inclusion of these limitations within the claim constitutes new matter not supported by the original disclosure.
In reference to dependent claim 9, claim 9 does not cure the deficiencies noted in the rejection of claim 8. Therefore, claim 9 is rejected under the same rationale as claim 8.
Regarding claim 10,
Claim 10, as amended, recites the limitations where, µl is an average of the l-th hidden layer for a normal dataset for training and Ul is a left singular vector obtained by performing a singular value decomposition calculation. Neither variable “µl” nor “Ul” is defined in the original disclosure, and neither is a “left singular vector” recited. Therefore the inclusion of these limitations within the claim constitutes new matter not supported by the original disclosure.
In reference to dependent claim 11, claim 11 does not cure the deficiencies noted in the rejection of claim 10. Therefore, claim 11 is rejected under the same rationale as claim 10.
Regarding claim 14,
Claim 14, as amended, recites the limitations a memory storing instructions; and a processor configured to execute the instructions to implement one or more units, the one or more units comprising:. No memory, processor, or any components that would inherently contain a memory and a processor such as a computer, a CPU, or a GPU is recited in the original disclosure. Therefore the inclusion of these limitations within the claim constitutes new matter not supported by the original disclosure.
In reference to dependent claims 15-19, claims 15-19 do not cure the deficiencies noted in the rejection of independent claim 14. Therefore, these claims are rejected under the same rationale as claim 14.
Regarding claim 18,
Claim 18, as amended, recites the same limitations that lack support within the original disclosure as in claim 10, and thus claim 18 is rejected for reciting new matter under an equivalent rationale.
In reference to dependent claim 19, claim 19 does not cure the deficiencies noted in the rejection of claim 18. Therefore, claim 19 is rejected under the same rationale as claim 18.
Claim Rejections - 35 USC § 112(b)
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-13 and 15 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Regarding claim 1,
Claim 1 as amended recites the limitation setting a threshold value for a latent vector for the normal data for training, a threshold value for the reconstruction data, and a threshold value for each of the L hidden layers included in the encoder;. However, “the L hidden layers”, referred to within the limitation, does not have antecedent basis as no “L hidden layers” are recited earlier in claim 1. Therefore it is unclear what “the L hidden layers” refers to, and thus the claim has indefinite scope. For examination purposes, the limitation will be interpreted as reading “setting a threshold value for a latent vector for the normal data for training, a threshold value for the reconstruction data, and a threshold value for each of L hidden layers included in the encoder;”.
In reference to dependent claims 2-13, claims 2-13 do not cure the deficiencies noted in the rejection of claim 1. Therefore, claims 2-13 are rejected under the same rationale as claim 1.
Regarding claim 5,
Claim 5 recites the term “the threshold value” numerous times, such as within the phrase “the threshold value is set to minimize a fall-out rate for normal data for each of the hidden layers except for the L-th hidden layer”. However, parent claim 1 as amended recites multiple threshold values, those being a threshold value for a latent vector for the normal data for training, a threshold value for the reconstruction data, and a threshold value for each of the L hidden layers included in the encoder;. Therefore, it is unclear which threshold recited in claim 1 is limited further within claim 5. Additionally, within the same phrase claim 5 recites the term “the L-th hidden layer”. However, “the L-th hidden layer” does not have antecedent basis as no “L-th hidden layer” is recited earlier in claim 5, or in parent claim 1. Therefore it is unclear what “the L-th hidden layer” refers to, and thus the claim has indefinite scope. For examination purposes, the claim will be interpreted as reading “The hierarchical network intrusion detection method of claim 1, wherein, in the setting of the threshold value for the reconstruction data, the threshold value is set to minimize a fall-out rate for normal data for each of the hidden layers except for an L-th hidden layer among the L hidden layers included in the encoder, and the threshold value is set to maximize a detection rate of abnormal data for the L-th hidden layer”.
Regarding claim 12,
Claim 12 as amended recites the limitation and the anomaly scores are compared with the respective threshold value for each of the L hidden layers included in the encoder to sequentially determine whether an intrusion into the target network data is detected. However, the term “the respective threshold value for each of the L hidden layers” does not clearly have antecedent basis, as no “respective threshold value for each of the L hidden layers” is mentioned earlier within claim 12 or within parent claim 1, although the similar term “a threshold value for each of the L hidden layers” is recited in claim 1. For examination purposes, the limitation will be interpreted as reading “and the anomaly scores are compared with a respective threshold value for each of the L hidden layers included in the encoder to sequentially determine whether an intrusion into the target network data is detected”. Additionally, claim 12 recites the phrase “processing proceeds to the (l+1)-th hidden layer”, however, the term “the (l+1)-th hidden layer” does not have antecedent basis, as no “(l+1)-th hidden layer” is mentioned earlier within claim 12 or within parent claim 1. For examination purposes, the phrase will be interpreted as reading “processing proceeds to an (l+1)-th hidden layer”.
In reference to dependent claim 13, claim 13 does not cure the deficiencies noted in the rejection of claim 12. Therefore, claim 13 is rejected under the same rationale as claim 12.
Regarding claim 15,
Claim 15 recites the term “the threshold value” numerous times, such as within the phrase “wherein the setting unit sets the threshold value to minimize a fall-out rate for normal data for each hidden layer except for the L-th hidden layer”. However, parent claim 14 as amended recites multiple threshold values, those being a threshold value for a latent vector for the normal data for training, a threshold value for the reconstruction data, and a threshold value for each of L hidden layers included in the encoder;. Therefore, it is unclear which threshold recited in claim 14 is limited further within claim 15. Additionally, within the same phrase claim 5 recites the term “the L-th hidden layer”. However, “the L-th hidden layer” does not have antecedent basis as no “L-th hidden layer” is recited earlier in claim 15, or in parent claim 14. Therefore it is unclear what “the L-th hidden layer” refers to, and thus the claim has indefinite scope. For examination purposes, the claim will be interpreted as reading “The hierarchical network intrusion detection system of claim 14, wherein the setting unit sets the threshold value for the reconstruction data to minimize a fall-out rate for normal data for each hidden layer except for an L-th hidden layer among the L hidden layers included in the encoder, and sets the threshold value to maximize a detection rate of abnormal data for the L-th hidden layer, based on the anomaly scores of the latent vector for the normal data for training, the reconstruction data, and the output value of each of the L hidden layers included in the encoder”.
Prior Art
The following references are used for prior art claim rejections:
Xu et al. “Improving Performance of Autoencoder-Based Network Anomaly Detection on NSL-KDD Dataset”
Nguimbous et al. “Anomaly-based Intrusion Detection Using Auto-encoder”
Mortensen “Fault Detection in Mobile Robotics Using Autoencoder and Mahalanobis Distance”
Marimont and Tarroni “Anomaly Detection through Latent Space Restoration using Vector-Quantized Variational Autoencoders”
Hashimoto et al. (U.S. Patent Application Publication No. 2022/0139092)
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-4 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Xu et al. “Improving Performance of Autoencoder-Based Network Anomaly Detection on NSL-KDD Dataset”, hereinafter Xu, in view of Marimont and Tarroni “Anomaly Detection through Latent Space Restoration using Vector-Quantized Variational Autoencoders”, hereinafter Marimont, further in view of Hashimoto et al. (U.S. Patent Application Publication No. 2022/0139092), hereinafter Hashimoto.
Regarding claim 1,
Xu teaches A hierarchical network intrusion detection method using a hierarchical network intrusion detection system based on hidden layer information of an autoencoder, ((Xu Abstract) “In this study, we propose a novel 5-layer autoencoder (AE)-based model better suited for network anomaly detection tasks”):
the hierarchical network intrusion detection method comprising: normalizing and preprocessing normal data for training in a state in which the normal data for training is collected; ((Xu Pg. 4) “The NSL-KDD dataset has two datasets, KDDTrain+ and KDDTest+, respectively. Though both datasets contains both normal and abnormal network traffic samples, we only use the normal network traffic samples from the KDDTrain+ for training. As seen in Fig. 3, we first use only the KDDTrain+ dataset after applying a number of data pre-processing techniques such as one-hot-encoding to transform the categorical features into numeric data, disposal of outliers, and normalizes the dataset by scaling them to fit in the range of [0, 1]”)
outputting reconstruction data ((Xu Pg. 3) “In the decoding operation, the hidden representation of (y) is mapped back into a reconstruction x-hat, as shown in equation (2)”) by inputting the preprocessed normal data for training ((Xu Pg. 4) “we only use the normal network traffic samples from the KDDTrain+ for training. As seen in Fig. 3, we first use only the KDDTrain+ dataset after applying a number of data pre-processing techniques”) into the autoencoder including an encoder and a decoder; ((Xu Pg. 3) “A generic autoencoder architecture consists of two operations, encoding and decoding respectively”)
calculating a reconstruction error by using the preprocessed normal data for training and the reconstruction data; ((Xu Pg. 4) “In the training phase, the original features of the network traffic are extracted and reduced by the encoding operation then represented in the latent space. The latent space is then used to reconstruct the output. The difference between the output traffic sample and the original traffic sample is compared and a reconstruction error is computed”)
training the autoencoder to minimize a reconstruction error value; ((Xu Pgs. 1-2) “The training phase of the AE model aims to reduce the reconstruction loss between the input and output”)
extracting hierarchical information of the trained autoencoder; ((Xu Pg. 4) “In the training phase, the original features of the network traffic are extracted and reduced by the encoding operation then represented in the latent space”)
setting…a threshold value for the reconstruction data, … ((Xu Pg. 4) “In the training phase, the original features of the network traffic are extracted and reduced by the encoding operation then represented in the latent space. The latent space is then used to reconstruct the output. The difference between the output traffic sample and the original traffic sample is compared and a reconstruction error is computed. Once all traffic samples are processed by the model, the max value of all reconstruction errors is marked as the threshold to identify anomalies”)
calculating anomaly scores of a latent vector for a target network data, the reconstruction data for the target network data, ((Xu Pg. 4) “The latent space is then used to reconstruct the output…During the testing phase, network traffic samples are inputted to the trained AE model and again a reconstruction error is calculated – it is called an anomaly score now”) and an output value of each of the L hidden layers included in the encoder, in a state in which the target network data is input to the autoencoder; ((Xu Pg. 7) “The visualization of the distribution between the normal and abnormal samples across KDDTrain+ and KDDTest+ in the latent space, in which the data lies in the bottleneck layer, is shown in Fig. 5”, Xu Pg. 4, Fig. 2 shows that the bottleneck layer, containing the latent space, and which is used to create reconstruction data which is used to create the reconstruction error, which is an anomaly score, relies on the output values of the hidden layers of the encoder)
PNG
media_image1.png
445
542
media_image1.png
Greyscale
and determining whether an intrusion into the target network data is detected by using the threshold values and the anomaly scores ((Xu Pg. 4) “During the testing phase, network traffic samples are inputted to the trained AE model and again a reconstruction error is calculated – it is called an anomaly score now. The anomaly score is compared with the threshold value obtained during the training phase. If the anomaly score is larger than the threshold, this traffic sample is now considered anomalous”)
Marimont more explicitly teaches the following further limitation than Xu:
setting a threshold value for a latent vector ((Marimont Pg. 1) “We found that the prior probability estimated by the AR model can be useful for unsupervised anomaly detection and enables the estimation of both sample and pixel-wise anomaly scores. The sample-wise score is defined as the negative log likelihood of the latent variables above a threshold selecting highly unlikely codes”, latent variables correspond to latent vectors) for the normal data for training, … ((Marimont Pg. 2) “A sample-wise anomaly score is a numerical indicator of how likely it is for a given sample to contain an anomaly. Scores are generally either density-based (based on an estimated probability of a sample) or reconstruction-based (based on the assumption that models trained on normal data will not be able to reconstruct anomalies)”)
At the time of filing, one of ordinary skill in the art would have motivation to combine Xu and Marimont by taking the method for detecting network intrusion using an autoencoder, including setting a threshold for reconstruction data of the autoencoder, taught by Xu, and additionally setting a threshold for latent variables of the autoencoder, taught by Marimont, as Marimont teaches: (Marimont Pg. 1) “We tested our approach on the MOOD challenge datasets, and report higher accuracies compared to a standard reconstruction-based approach with VAEs”. Such a combination would be obvious.
Hashimoto more explicitly teaches the following further limitation than either Xu or Marimont:
setting…and a threshold value for each of the L hidden layers included in the encoder; ((Hashimoto [0109]) “The neurons in adjacent layers are connected as appropriate, and a weight (connected load) is set for each connection. A threshold value is set for each neuron and, fundamentally, the output of each neuron is determined by whether the sum of the product of each input and each weight exceeds the threshold value. The weights of the connections of neurons that are included in each of the layers 521 to 523 of the encoder 52 and the threshold values of the neurons are examples of computational parameters of the encoder 52”, threshold values for neurons within each layer of an encoder includes a threshold value for each hidden layer included in the encoder)
At the time of filing, one of ordinary skill in the art would have motivation to combine Xu, Marimont, and Hashimoto by taking the method for detecting network intrusion using an autoencoder, including setting a threshold for reconstruction data of the autoencoder and setting a threshold for a latent vector of the autoencoder, jointly taught by Xu and Marimont, and additionally setting a threshold for each layer of the encoder, taught by Hashimoto, as activation thresholds as described by Hashimoto are a standard component of neural networks, such as the encoder portion of an autoencoder, that are well-known in the art, and impart the predictable benefit of introducing non-linear properties to a neural network, allowing it to solve non-linear problems. Such a combination would be obvious.
Regarding claim 2,
Xu, Marimont, and Hashimoto jointly teach The hierarchical network intrusion detection method of claim 1,
Xu further teaches:
wherein the outputting of the reconstruction data by inputting the preprocessed normal data for training into the autoencoder comprises: outputting the latent vector by inputting the preprocessed normal data for training into the encoder; ((Xu Pg. 3) “In the encoding operation, any input sample x is an m dimensional vector [x1, x2, x3, …, xm] and is mapped to the hidden layer representation (y)”, (Xu Pg. 4) “we propose a 5-layer AE architecture. The AE encodes the 122-dimensional features representation (x) into a 32-dimensional vector (m) which is further reduced as a 5-dimensional vector (a)”)
and outputting the reconstruction data by inputting the latent vector to the decoder ((Xu Pg. 3) “In the decoding operation, the hidden representation of (y) is mapped back into a reconstruction x-hat”, (Xu Pg. 4) “The AE encodes the 122-dimensional features representation (x) into a 32-dimensional vector (m) which is further reduced as a 5-dimensional vector (a) and then decodes it back to the same input features space”)
At the time of filing, one of ordinary skill in the art would have motivation to combine the method jointly taught by Xu, Marimont, and Hashimoto for the parent claim of claim 2, claim 1. No new embodiments are introduced, so the reason to combine is the same as for the parent claim.
Regarding claim 3,
Xu, Marimont, and Hashimoto jointly teach The hierarchical network intrusion detection method of claim 1,
Xu further teaches:
wherein, in the calculating of the reconstruction error, the reconstruction error is calculated by using the preprocessed normal data for training for a training process, the reconstruction data of the decoder for the preprocessed normal data for training, ((Xu Pg. 4) “In the training phase, the original features of the network traffic are extracted and reduced by the encoding operation then represented in the latent space. The latent space is then used to reconstruct the output. The difference between the output traffic sample and the original traffic sample is compared and a reconstruction error is computed”)
and a mean squared error (MSE) loss function and by using an equation which is:
PNG
media_image2.png
101
346
media_image2.png
Greyscale
((Xu Pgs. 7-8) “The aim of this experiment was to understand the sensitivity of different reconstruction loss functions to the detection accuracy. The three reconstruction loss functions were studied:…and Mean Squared Error (MSE), respectively. The definitions of these functions are described in the following Equations.”, Xu Equation 14 shows a corresponding equation)
PNG
media_image3.png
60
412
media_image3.png
Greyscale
where, J is a loss function, ((Xu Pgs. 7-8) “three reconstruction loss functions were studied…and Mean Squared Error (MSE)”)
Xnor is preprocessed normal data set for training, X-hatnor is the reconstruction data for a preprocessed normal dataset for training, ((Xu Pg. 8) “To examine the effect of reconstruction error function more closely, Fig. 6 visualizes the relationship between thresholds and the range of reconstruction error computed across the network traffic samples in the KDDTest+ dataset labeled between normal and abnormal”, (Xu Pg. 4) “we only use the normal network traffic samples from the KDDTrain+ for training. As seen in Fig. 3, we first use only the KDDTrain+ dataset after applying a number of data pre-processing techniques such as one-hot-encoding to transform the categorical features into numeric data, disposal of outliers, and normalizes the dataset by scaling them to fit in the range of [0, 1]”)
N is the number of data samples of the normal dataset for training, ((Xu Pg. 8) “where n indicates the total number of traffic samples”)
xnor,n is an N-th sample of Xnor, ((Xu Pg. 8) “where…xi is the representation of the original input sample”)
and x-hatnor,n is an N-th sample of X-hatnor ((Xu Pg. 8) “where…x-hati is the output represented at the latent space”)
At the time of filing, one of ordinary skill in the art would have motivation to combine the method jointly taught by Xu, Marimont, and Hashimoto for the parent claim of claim 3, claim 1. No new embodiments are introduced, so the reason to combine is the same as for the parent claim.
Regarding claim 4,
Xu, Marimont, and Hashimoto jointly teach The hierarchical network intrusion detection method of claim 1, wherein the training of the autoencoder comprises:
Xu further teaches:
training the encoder by setting the preprocessed normal data for training ((Xu Pg. 4) “we only use the normal network traffic samples from the KDDTrain+ for training. As seen in Fig. 3, we first use only the KDDTrain+ dataset after applying a number of data pre-processing techniques”) as input data of the encoder and setting the latent vector as output data of the encoder; ((Xu Pg. 4) “In the training phase, the original features of the network traffic are extracted and reduced by the encoding operation then represented in the latent space”)
training the decoder by setting the latent vector as input data of the decoder ((Xu Pg. 7) “The latent space contains a compressed representation of the traffic samples which is the only information the decoder uses to try to reconstruct the input”) and setting the reconstruction data as output data of the decoder; ((Xu Pg. 3) “In the decoding operation, the hidden representation of (y) is mapped back into a reconstruction x-hat, as shown in equation (2)”)
At the time of filing, one of ordinary skill in the art would have motivation to combine the method jointly taught by Xu, Marimont, and Hashimoto for the parent claim of claim 4, claim 1. No new embodiments are introduced, so the reason to combine is the same as for the parent claim.
Regarding claim 14,
Claim 14 recites a system for performing the function of the method of claim 1. All other limitations in claim 14 are substantially the same as those in claim 1, therefore the same rationale for rejection applies.
Claims 5 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Xu, in view of Marimont, further in view of Hashimoto, further in view of Nguimbous et al. “Anomaly-based Intrusion Detection Using Auto-encoder”, hereinafter Nguimbous.
Regarding claim 5,
Xu, Marimont, and Hashimoto jointly teach The hierarchical network intrusion detection method of claim 1,
Nguimbous teaches the following further limitation that neither Xu, nor Marimont, nor Hashimoto teaches:
wherein, in the setting of the threshold, based on the anomaly scores of the latent vector for the normal data for training, the reconstruction data, and the output value of each of the L hidden layers included in the encoder, the threshold value is set to minimize a fall-out rate for normal data for each of the hidden layers except for the L-th hidden layer among the L hidden layers included in the encoder, and the threshold value is set to maximize a detection rate for abnormal data of the L-th hidden layer ((Nguimbous Pg. 3) “The goal is to select a threshold minimizing both FP(η), false positive rate, that is, the rate of alarm raised for system normal behaviour and false negative rate FN(η), that is the rate of malicious behaviour not detected. This can be formulated as a dual optimization problem:Minimize |X| with X ⊂ Xtarget \ ∀ x ∈ X, x is labelled as outlier by the algorithm, FP (False Positive) area in Figure 1 representing false alarms.Minimize |X| with X ⊂ Xoutlier \ ∀ x ∈ X, x is labelled as normal by the algorithm, FN (False Negative) area in Figure 1 representing undetected anomalies
…To attain the trade-off, we firstly select a set of values minimizing FP(η)…we ensure that at least 95% of training error reconstruction falls under the threshold, thereby minimizing False Positive Rate. After selecting the set of best candidate thresholds, during the cross-validation, False Negative Rate F N(η) is then computed for each threshold candidate η, and finally the threshold value with the lowest F N(η) is selected as the optimal threshold”, dually optimizing false positive rate and false negative rate by first choosing candidate thresholds that minimize false positive rate, then selecting a threshold from the candidates that minimize false negative rate corresponds to the threshold minimizing fall-out rate for earlier layers and maximizing detection rate in the last layer)
At the time of filing, one of ordinary skill in the art would have motivation to combine Xu, Marimont, Hashimoto, and Nguimbous by taking the method of claim 1, taught jointly by Xu, Marimont, and Hashimoto, and including selecting a threshold that minimizes false positive rate for earlier layers and maximizes the detection rate (i.e. minimizes false negative rate) for the last layer, taught by Nguimbous, as Nguimbous teaches: (Nguimbous Pg. 3) “Since too low sensitivity results in excessive losses due to undetected anomalies, while too high sensitivity results in wasting resources on investigating false detections, finding an optimal threshold is a challenging problem [6]. The goal is to select a threshold minimizing both FP(η), false positive rate, that is, the rate of alarm raised for system normal behaviour and false negative rate FN(η), that is the rate of malicious behaviour not detected”. Such a combination would be obvious.
Regarding claim 15,
Claim 15 recites a system for performing the function of the method of claim 5. All other limitations in claim 15 are substantially the same as those in claim 5, therefore the same rationale for rejection applies.
Claims 6 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Xu, in view of Marimont, further in view of Hashimoto, further in view of Mortensen “Fault Detection in Mobile Robotics Using Autoencoder and Mahalanobis Distance”, hereinafter Mortensen.
Regarding claim 6,
Xu, Marimont, and Hashimoto jointly teach The hierarchical network intrusion detection method of claim 1,
Mortensen teaches the following further limitations that neither Xu, nor Marimont, nor Hashimoto teach:
wherein, in the calculating of the anomaly scores, the anomaly score of the latent vector for the network data is calculated ((Mortensen Abstract) “The content of this thesis is an investigation into the applicability of Autoencoders for fault detection in mobile robotics by assigning anomaly scores to sampled torque signals based on the Autoencoder reconstruction errors and the Mahalanobis distance to a known distribution of healthy errors”) by using an equation which is:
PNG
media_image4.png
100
726
media_image4.png
Greyscale
(Mortensen Pg. 12, Equation 7 shows a corresponding equation)
PNG
media_image5.png
36
497
media_image5.png
Greyscale
where ϵ is an anomaly score [of randomly input network data], ((Mortensen Pg. 12) “Figure 3b shows how the Mahalanobis distance provides a better estimate of the anomalousness of a sample”, Xu teaches an anomaly score of network data)
LMD is a measurement value of Mahalanobis distance (MD), ((Mortensen Pg. 12) “The Mahalanobis distance which is defined in Equation 7”)
h is latent vector ((Mortensen Pg. 10) “We can consider a sample to be scored as a vector e = {e1, e2, ..., ep}”) of an encoder [for network data], ((Mortensen Pg. 10) “For a formal definition of an Autoencoder, we can consider the function fθ(x) = h as the encoder mapping the input x = {x1, x2, ..., xn} into a feature vector h = {h1, h2, ..., hk},”)
μnor is an average of latent vector of an encoder to which normal data for training is input, ((Mortensen Pg. 12) “µ ∈ Rp is the center of the distribution, in other words the vector of mean values from the samples”)
Σnor is a latent vector covariance of normal data for training, ((Mortensen Pg. 12) “The Mahalanobis distance which is defined in Equation 7 is a measure better suited for multivariate data with correlations as it considers the distribution of the points, which is done by incorporating the covariance matrix”)
and T denotes a transpose matrix (Mortensen Pg. 12, Equation 7 shows a corresponding symbol modifying the difference of the sample vector e and the mean vector µ, which is a matrix)
At the time of filing, one of ordinary skill in the art would have motivation to combine Xu, Marimont, Hashimoto, and Mortensen by taking the method of claim 1, taught jointly by Xu, Marimont, and Hashimoto, and including using Mahalanobis distance to compute anomaly scores, taught by Mortensen, as Mortensen teaches: (Mortensen Pg. 12) “In cases where the variables are uncorrelated the Euclidean distance may be a useful metric to find outliers. However, in cases where some correlation between the variables can be observed it will not provide useful information in terms of the distance to the cluster, as can be seen in Figure 3a. The Mahalanobis distance which is defined in Equation 7 is a measure better suited for multivariate data with correlations as it considers the distribution of the points, which is done by incorporating the covariance matrix [25]. Figure 3b shows how the Mahalanobis distance provides a better estimate of the anomalousness of a sample, as points which are further away from the cluster are scored higher than those closer to it”. Such a combination would be obvious.
Regarding claim 16,
Claim 16 recites a system for performing the function of the method of claim 6. All other limitations in claim 16 are substantially the same as those in claim 6, therefore the same rationale for rejection applies.
Allowable Subject Matter
Claims 7-13 are not rejected over any of the cited prior art, however they remain rejected under 35 U.S.C. 112(b). Claims 8-11 and 17-19 are not rejected over any of the cited prior art, however they remain rejected under 35 U.S.C. 112(a).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Ikeda et al. (U.S. Patent Application Publication No. 2020/0349470) discloses an apparatus that distinguishes between normal data and anomaly data using an autoencoder.
Gyllenhammar et al. (U.S. Patent Application Publication No. 2022/0161816) discloses management of an Automated Driving System (ADS) of a vehicle including an autoencoder, wherein anomalous behavior encountered by the ADS is identified.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to VICTOR A NAULT whose telephone number is (703) 756-5745. The examiner can normally be reached M - F, 12 - 8.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Miranda Huang can be reached at (571) 270-7092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/V.A.N./Examiner, Art Unit 2124
/Kevin W Figueroa/ Primary Examiner, Art Unit 2124
Prosecution Insights