DETAILED ACTION
This communication is in response to the Amendments and Arguments filed with Request for Continued Examination on November 20th, 2025. Claims 1-20 have been examined and are pending.
All previous objections/rejections not mentioned in this Office Action have been Withdrawn by Examiner.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority
Applicant claims the benefit of US Provisional Application No. 63/326420, filed April 1, 2022. Claims 1-20 have been afforded the benefit of this filing date.
Response to Arguments and Amendments
35 U.S.C. 101
Regarding eligibility of amended claim 1, Applicant argues, "[t]he claim recites a specific and concrete technical operation that includes transforming raw entity-related text into property=value strings tied to firmware/OS," and "these elements impose a meaningful limit on any supposed abstract idea, and directly result in an improvement to the technical field of classifying entities on a computer network... it specifies a particular representational form, and a particular modeling technique of using NLP to process string-based properties to generate embedding vectors, which serve as the basis to select better properties that are indicative of an entity classification.," (pages 7 and 8 of Applicant’s Remarks).
Applicant’s argument is persuasive; accordingly, the rejections under 35 U.S.C. 101 are withdrawn.
35 U.S.C. 103
Regarding the combination of references Lee and Mitelman under 35 U.S.C. 103, Applicant argues, “Lee tokenizes predefined categorical NetFlow features and embeds those tokens within a time-series pipeline for anomaly/threat classification,” (page 9 of Applicant’s Remarks) “Mitelman, meanwhile describes device profiling using feature sets and classifiers drawn from OS/application/network data but does not disclose converting raw text into property=value strings or applying any NLP model to generate per-entity numerical vectors,” and, “even combined, missing in the references in any teaching or suggestion to apply any NLP model to property=value character strings to produce per-entity vectors, as now recited in Applicant’s claim 1.”
Applicant’s argument is moot, as new grounds of rejection are made in view of U.S. Patent Application Publication 2022/0210079 to Koren et al. Further details are provided below.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-5, 8-12 and 15-19 is/are rejected under 35 U.S.C. 102(a)(2) as being anticipated by U.S. Patent Application Publication 2022/0210079 to Koren et al. (hereinafter, "Koren").
Regarding claims 1, 8 and 15, Koren teaches a method, system and computer readable medium comprising: obtaining raw text information associated with a plurality of entities (paragraph [0064], "Aggregation device 106 may further provide log information of activity and properties of network coupled devices 122a-b to network monitor entity 102.");converting, by a processing device, the raw text information for each entity of the plurality of entities into one or more character strings wherein the one or more character strings comprises an identifier of a property and a value corresponding to the property, and wherein the property is associated with a firmware or an operating system of a respective one of the plurality of entities (paragraph [0030], "Embodiments may use one or more optimization techniques to use fewer or selected properties while increasing efficiency without losing accuracy. The optimization techniques can include training a model on the properties available in an unknown set of entities. The known set of devices or entities is a set of entities where enough properties (e.g., as property key value pairs) are available for classifying the entities," and paragraph [0019], "Embodiments may be used with hierarchies of labels used for classification (e.g., classifications labels) and with a taxonomy tree that uses taxonomy trees for function, operating system (OS), and vendor. The labels may also be referred to as tags, identifiers, etc. The taxonomy for an operating system may include a particular operating system (e.g., Windows™, Linux, MacOS™, etc.), versions of each operating system, and patch level or service pack level.");applying, by the processing device, a natural language processing (NLP) model to the one or more character strings to generate a numerical vector for each entity of the plurality of entities based on the one or more character strings for each entity (paragraph [0029], "For feature extraction, embodiments can use domain knowledge (e.g., a model customized for classification granularity level) to increase efficiency without losing accuracy. A feature may be one or more properties which when combined represent a feature of an entity. A property may be associated with one or more features. A feature can be a keyword or a keyword count. A feature may be a set of distinguishing characteristics for each class of an entity. The domain knowledge can include keywords (e.g., select or predefined keywords) that have been determined to be useful for classification (e.g., by a researcher, profiles, models, etc.). For example, keywords may be used to select property values from an Nmap string associated with one or more entities," and paragraph [0104], "The properties and associated data (e.g., property values, keywords, fingerprints variables, fields, etc.) may also be featurized at block 410 to generate one or more features. The values, keywords, variables, fields, etc., may be featurized (e.g., converted to a different format or value that is recognized or used by a machine learning model, such as a vector of numbers) to generate the set of features. Featurization is the process of encoding, converting, transforming, etc., information into numerical form for use with one or more models.");selecting, based on the numerical vectors for each entity of the plurality of entities, one or more entity properties to be used for entity classification (paragraph [0029], "In some embodiments, keyword counts may also be used as data for training classification models and classifying entities. This allows selection of information that is relevant to classification and putting it in numerical form which can then be used for training (e.g., of a model).");generating a classification model based on the one or more entity properties (paragraph [0030], "Embodiments may train a model at a granularity level based on data from the known set of entities. For example, a model at a particular granularity level may be trained based on properties that are more readily available in the unknown set.");monitoring network traffic associated with a first entity that is coupled to a network (paragraph [0051], "Network monitor entity 102 may be communicatively coupled to the network device 104 in such a way as to receive network traffic flowing through the network device 104 (e.g., port mirroring, sniffing, acting as a proxy, passive monitoring, etc.)."); andperforming a classification of the first entity by applying the classification model to the network traffic (paragraph [0042], "Network monitor entity 102 can perform the classification using one or more models each with an associated level (e.g., granularity) to provide more efficient and accurate classification.").
Regarding claims 2, 9 and 16, Koren further teaches a similarity between the numerical vectors indicates a similar device type for respective entities (paragraph [0104], "The properties and associated data (e.g., property values, keywords, fingerprints variables, fields, etc.) may also be featurized at block 410 to generate one or more features. The values, keywords, variables, fields, etc., may be featurized (e.g., converted to a different format or value that is recognized or used by a machine learning model, such as a vector of numbers) to generate the set of features… The information in numerical form can then be used by a machine learning model to infer or determine a classification. A feature may be a set of distinguishing characteristics for each class of an entity. For example, a feature may be a set of particular properties associated with a particular class of entities.").
Regarding claims 3, 10 and 17, Koren further teaches the classification model is a machine learning model, trained with the one or more entity properties (paragraph [0083], "Machine learning model 311 may be trained to determine a first classification (e.g., a first level classification) for an entity based on the features 305 (e.g., based on one or more properties) associated with the entity.").
Regarding claims 4, 11 and 18, Koren further teaches performing the classification of the first entity further comprises: generating, by the classification model, a probability vector indicating a likelihood of the first entity being each of a plurality of entity types (paragraph [0105], "At block 415, a first set of classifications (e.g., one or more classifications) is determined based on a first machine learning model. The first set of classifications may be an inference determined based on the first machine learning model and the information associated with the entity (e.g., features). The classification may be a list of numbers (e.g., associated with a profile) representing one or more confidence values. This list of numbers may be list of probabilities (e.g., associated with classifications).").
Regarding claims 5, 12 and 19, Koren further teaches selecting the entity type of the probability vector indicating a highest likelihood for classification of the first entity (paragraph [0111], "If at least one confidence level is above the confidence level threshold, block 445 may be performed. If there are no confidence levels above the threshold, block 460 may be performed. At block 445, the first set of classifications and the second set of classifications may be stored. At block 460, the first set of classifications may be stored. The classification may further be used to apply one or more policies, rules, or other security procedures or actions to the entity. In some embodiments, the confidence associated with the classification may be output and stored, etc.").
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 6 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over Koren in view of “Impact of minority class variability on anomaly detection by means of random forests and support vector machines” by Alraddadi et al. (hereinafter “Alraddadi”).
Regarding claims 6 and 13, Koren does not explicitly teach “the classification model comprises at least one of a logistic regression or a random forest classifier,” and thus, Alraddadi is introduced.
Alraddadi teaches the classification model comprising at least one of a logistic regression or a random forest classifier (section 1, paragraph 2, "In this article, we study the behavior of Support Vector Machines (SVMs) and Random Forests (RFs) when they are applied to problems of increasing imbalance in the cybersecurity context," and section 3.3, paragraph 1, "In order to analyze the effect of highly unbalanced datasets on cyberattack detection, we explore the use of two of the most widely used machine learning algorithms in this context: RFs and SVMs.").
Koren and Alraddadi are considered analogous as they are each concerned with network traffic analysis. Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to substitute Alraddadi’s random forest classifier for Koren’s trained classifier model for the purpose of improving classification performance.
Claims 7, 14 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Koren in view of U.S. Patent Application Publication 2020/0382527 to Mitelman et al. (hereinafter “Mitelman”).
Regarding claims 7, 14 and 20, Koren does not explicitly teach “ranking a plurality of entity properties based on correlations with the numerical vectors of the plurality of entities,” or “selecting a subset of the plurality of entity properties based on the ranking,” and thus, Mitelman is introduced.
Mitelman teaches ranking a plurality of entity properties based on correlations with the numerical vectors of the plurality of entities (paragraph [0042] with Fig. 2 and 4, "…the supervised machine learning engine 122 generates confidence score data 222 representing a confidence score for the classification (i.e., a confidence regarding the determined network profile for the network device).") and selecting a subset of the plurality of entity properties based on the ranking (paragraph [0038] with Fig. 4, "The features sets are candidate feature sets, in that the active machine learning engine 124 may filter the candidate feature sets. The filtering discriminates among the candidate feature sets to select a representative subset of the candidate feature sets; and the active machine learning engine 124 may then take action to determine the correct classifications, or labels, for these feature sets.").
Koren and Mitelman are considered analogous because they are each concerned with device profiling. Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified Koren with the teachings of Mitelman for the purpose of improving classification performance. Given that all the claimed elements were known in the prior art, one skilled in the art could have combined the elements by known methods with no change in their respective functions, and the combination would have yielded nothing more than predictable results.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
U.S. Patent 10,652,116 to Zhang et al.
U.S. Patent Application Publication 2017/0235846 to Atlas et al.
U.S. Patent Application Publication 2019/0248576 to Faigon et al.
U.S. Patent Application Publication 2019/0349263 to Ghosh et al.
U.S. Patent Application Publication 2021/0021621 to Janakiraman.
U.S. Patent Application Publication 2022/0083900 to Khanna.
U.S. Patent Application Publication 2022/0092087 to Raghuramu et al.
China Publication 107193959 to Zhang et al.
Singapore Patent Application 10202008469R to Lee et al.
Sun, Yanxiong, et al. "Application research of text classification based on random forest algorithm." 2020 3rd international conference on advanced electronic materials, computers and software engineering (aemcse). IEEE, 2020.
Zeng, Li, and Zili Li. "Text classification based on paragraph distributed representation and extreme learning machine." Advances in Swarm and Computational Intelligence: 6th International Conference, ICSI 2015 held in conjunction with the Second BRICS Congress, CCI 2015, Beijing, June 25-28, 2015, Proceedings, Part II 6. Springer International Publishing, 2015.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SEAN T SMITH whose telephone number is (571)272-6643. The examiner can normally be reached Monday - Friday 8:00am - 5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, PIERRE-LOUIS DESIR can be reached at (571) 272-7799. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SEAN THOMAS SMITH/Examiner, Art Unit 2659
/PIERRE LOUIS DESIR/Supervisory Patent Examiner, Art Unit 2659