Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This action is responsive to amendment application filed October 17, 2025.
Status of Claims
Applicant amended the claims. Claims 1-3,5-10,12-14 remain pending.
Response to Arguments
Applicant’s arguments/amendments, filed 10/17/25, have been fully considered and are persuasive. Therefore, the previous rejection has been withdrawn. However, upon further consideration, a new grounds of rejection is made based on Perilli in view of Long in view of Hassanzadeh.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-3,5-10,12-14 rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
In claim 1, line 4 and also lines 7-8 recite detecting “a security”. However, this limitation is unclear if it is referring to the same security anomaly or different ones.
Claim 1, line 10 recites the limitations "… based on the collected data” and “wherein the analyzing”. There is insufficient antecedent basis for these limitations in the claim.
Claim 1, line 12 recites the limitation "one other environment". It is unclear if this is referring to the “two different environments” or how it relates to the environments. Clarification is required.
Independent claim 8 is a slight variation of claim 1 and is rejected based on the same rationale.
Dependent claims inherit the deficiencies of the independent claims respectively, fail to remedy said deficiencies, and are thus rejected based upon the same rationale given above.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3,6-10,13-14 are rejected under 35 U.S.C. 103 as being unpatentable over Perilli et al (US Publication 20190312890) in view of Long et al (US Publication 20190005237) in view of Hassanzadeh et al (US Patent 10148685)
In reference to claim 1, Perilli teaches a security management method of an environment in which a plurality of environments are connected to each other through a network, the security management method comprising:
detecting a security anomaly occurring through an attack surface existing in a device included in each of the plurality of environments or in a network connection section between the plurality of environments; (see at least ¶ 18, which teaches detecting a cyber attack in a network environment)
collecting attack data related to the detected security anomaly and analyzing an attack type based on the collected data; (see at least ¶s 23-24, which teaches collecting attack characteristics and analyzing the type of attack)
dynamically combining response techniques based on the analyzed attack type; (see at least ¶ 33, which teaches determining a combination of response strategies based on the attack characteristics) and
performing an automatic response to the security anomaly based on the combined response techniques (see at least ¶ 34, which teaches using the response strategies against the cyber attack),
wherein the dynamically combining of the response techniques based on the analyzed attack type comprises: analyzing an attack type of each of a plurality of security threats included in the security anomaly from the collected attack data, and dynamically combining the response techniques based on each of the plurality of security threats and the analyzed attack type (see at least ¶ 33, which teaches analyzing the attack based on the collected attack characteristics, and further teaches combining response strategies according to the stage of the attack to perform a comparative analysis between the techniques).
Perilli fails to explicitly teach Internet of blended environment (loBE). However, Long teaches identifying and protecting against cyber attacks, and discloses different types of environments with IoT networks and smart networks. (see Long, at least Background and ¶ 28). It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to modify Perilli based on the teachings of Long for the purpose of improving defense against malicious and harmful attacks on networks.
Perilli fails to explicitly teach wherein the detecting comprises analyzing data generated from at least two different environments of the plurality of environments to detect a security anomaly that is not detected through a pre-established security device; and, wherein the analyzing comprises estimating the attack type by analyzing a mutual correlation between the collected attack data and data generated from at least one other environment of the plurality of environments. However, Hassanzadeh teaches security management across connected network domain environments (see Hassanzadeh, at least Abstract & Background). Hassanzadeh discloses analyzing data from two different network domain environments to detect a security threat that is not detected through other devices (see Hassanzadeh, at least column4 lines 30-55 and column 5 lines 22-41), and further discloses identifying the attack type by correlating between the collected data and a pattern recognition (see Hassanzadeh, at least column 6 lines 32-67). It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to modify Perilli based on the teachings of Hassanzadeh for the purpose of improving security operations across network domain environments
In reference to claim 2, this is taught by Perilli, at least ¶s 19-20, which teaches detecting the cyber attack through a device in the network environment, and through log data associated with the attack.
In reference to claim 3, this is taught by Perilli, at least ¶s 20,26, which teaches comparing the attack type with prior attacks, and correlating the attack to previously related attack information.
In reference to claim 6, this is taught by Perilli, at least ¶ 32,34, which teaches updating the engine configuration according to the attack type and response.
In reference to claim 7, this is taught by Long, at least ¶ 28, which teaches at least smart grid and medical networks. One of ordinary skill in the art would be motivated to modify Perilli based on the teachings of Long in accordance to the rationale given for claim 1.
Claims 8-10,13-14 are slight variations of claims 1-3,6-7 above, and are therefore rejected based upon the same rationale.
Claims 5,12 are rejected under 35 U.S.C. 103 as being unpatentable over Perilli et al (US Publication 20190312890) in view of Long et al (US Publication 20190005237) in view of Hassanzadeh et al (US Patent 10148685) in further view of Atencio et al (US Publication 20200135049).
In reference to claim 5, this is taught by Perilli, at least ¶ 33, which teaches using the cyber security engine and combining response strategies that correlate to other cyber attacks.
Perilli fails to explicitly teach combining the responses “…based on a cyber kill chain stage of each…”. However, “Official Notice” is taken that cyber kill chain is a term of the art which is old and well known in the field of cyber security, where each stage of a cyber kill chain is used for responding to a cyber attack. Furthermore, Atencio teaches evaluating security threat responses based on a comparison with Cyber Kill Chain concepts (see Atencio, at least ¶s 89,90,96). It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to modify Perilli to include cyber kill chain analysis for the purpose of better understanding the scope of the attack and responding accordingly.
Claim 12 is slight variations of claim 5 above, and is therefore rejected based upon the same rationale.
Conclusion
For any subsequent response that contains new/amended claims, Applicant is required to cite its corresponding support in the specification. (See MPEP chapter 2163.03 section (I.) and chapter 2163.04 section (I.) and chapter 2163.06) Applicant may not introduce any new matter to the claims or to the specification.
In formulating a response/amendment, Applicant is encouraged to take into consideration the prior art made of record but not relied upon, as it is considered pertinent to applicant's disclosure. See attached Form 892.
Contact & Status
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RAMY M OSMAN whose telephone number is (571)272-4008. The examiner can normally be reached Mon-Fri, 9AM-5PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ario Etienne can be reached at 571-272-4001. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users.
To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov.
Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and
https://www.uspto.gov/patents/docx for information about filing in DOCX format.
For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Ramy M Osman/
Primary Examiner, Art Unit 2457
January 20, 2026