DETAILED ACTION
This action is responsive to the claims filed on 05/08/2023. Claims 1-16 are pending for examination.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 08/22/2023 are in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-16 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Statutory Categories
Claims 1-15 are directed to a method.
Claim 16 is directed to an system.
Independent Claims – Claims 1 and 16
Step 2A Prong 1: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes. Independent claims 1 and 16 recites limitations that are abstract ideas in the form of mental processes:
Claim 1 recites:
processing, … the network data to generate data that represents invariant properties of the network (this limitation merely recites processing network data at a high level of generality such that is being considered mental processes of evaluation which can reasonably be performed in human mind or with aid additional aid of pen and paper)
processing, … the network data to generate a multi-layer graph model of the network (this limitation merely recites processing network data at a high level of generality such that is being considered mental processes of evaluation which can reasonably be performed in human mind or with aid additional aid of pen and paper)
processing, … the data that represents invariant properties of the network and the multi-layer graph model of the network … to select one or more network verification mechanisms for the network (this limitation merely recites processing network data at a high level of generality such that is being considered mental processes of evaluation which can reasonably be performed in human mind or with aid additional aid of pen and paper)
Claim 1 also recites the following additional elements for the purposes of Step 2A Prong Two
analysis:
A method for verifying a network, the method comprising: obtaining, by a classical computer, network data from the network, wherein the network data comprises network monitoring data and network configuration data; (obtaining networked monitored data is merely data gathering and is considered insignificant extra-solution activity under MPEP 2106.05(g))
by the classical computer (processing using a classical computer, stated at a high level of generality, is being considered as mere instructions to apply an exception using generic computer, see MPEP 2106.05(f))
by a quantum computer (processing using a quantum computer, stated at a high level of generality, is being considered as mere instructions to apply an exception using generic computer, see MPEP 2106.05(f))
using a quantum machine learning decision engine (processing using a quantum machine learning decision engine, stated at a high level of generality, is being considered as mere instructions to apply an exception, see MPEP 2106.05(f))
And initiating a live check of the network using the verification mechanisms to validate the network. (initiating using the verification mechanisms, stated at a high level of generality, is being considered as mere instructions to apply an exception, see MPEP 2106.05(f))
The additional limitations fail step 2A Prong 2 of the 101 analysis because they do not transform the claim into a practical application. These limitations are too abstract or lack technical improvement that would make the concept practically useful. Without clear utility or integration into a specific field, the claim does not relate to any particular application. It does not meet the requirements of Step 2A Prong 2, as it fails to make the concept meaningfully applicable in practice.
Since the claim as a whole, looking at the additional elements individually and in combination, does not contain any other additional elements that are indicative of integration into a practical application, the claim is “directed” to an abstract idea. This claim recites the following additional elements for the purposes of Step 2B analysis:
A method for verifying a network, the method comprising: obtaining, by a classical computer, network data from the network, wherein the network data comprises network monitoring data and network configuration data; (obtaining network monitored data is merely data gathering and is considered insignificant extra-solution activity under MPEP 2106.05(g), furthermore it should be noted that the courts have recognized receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information) as well-understood, routine, and conventional activity.)
by the classical computer (processing using a classical computer, stated at a high level of generality, is being considered as mere instructions to apply an exception using generic computer, see MPEP 2106.05(f))
by a quantum computer (processing using a quantum computer, stated at a high level of generality, is being considered as mere instructions to apply an exception using generic computer, see MPEP 2106.05(f))
using a quantum machine learning decision engine (processing using a quantum machine learning decision engine, stated at a high level of generality, is being considered as mere instructions to apply an exception, see MPEP 2106.05(f))
And initiating a live check of the network using the verification mechanisms to validate the network. (initiating using the verification mechanisms, stated at a high level of generality, is being considered as mere instructions to apply an exception, see MPEP 2106.05(f))
The claim also fails Step 2B of the analysis because the additional limitations do not amount to significantly more than the abstract idea itself. The additional limitations do not enhance the claim in a way that would move it beyond its abstract ideas as they minimally elaborate on the core concept without adding any inventive or technical substance. Considering the additional elements individually and in combination, and the claim as a whole, the additional elements do not provide significantly more than the abstract idea. Therefore, the claim is not patent eligible.
Claim 16 recite limitations substantially similar to claim 1, as such a similar analysis applies.
Claim 16 recites an additional limitation for consideration:
A system comprising: one or more classical processors; and quantum computing hardware; (Under step 2A prong II and step 2B, this limitation is invoking computers or other machinery merely as a tool to perform an existing process, see MPEP 2106.05(f))
Dependents of Claim 1
The remaining dependent claims corresponding to independent claim 1 do not recite additional elements, whether considered individually or in combination, that are sufficient to integrate the judicial exception into a practical application or amount to significantly more than the judicial exception. The analysis of which is shown below:
The claims below recite additional limitations which fail step 2A Prong 2 of the 101 analysis because they do not transform the claim into a practical application. These limitations are too abstract or lack technical improvement that would make the concept practically useful. Without clear utility or integration into a specific field, the claim does not relate to any particular application. It does not meet the requirements of Step 2A Prong 2, as it fails to make the concept meaningfully applicable in practice.
The claims also fails Step 2B of the analysis because the additional limitations do not amount to significantly more than the abstract idea itself. The additional limitations do not enhance the claim in a way that would move it beyond its abstract ideas as they minimally elaborate on the core concept without adding any inventive or technical substance. The claims are unpatentable.
Claim 2 recites the additional limitation of:
The method of claim 1, wherein the multi-layer graph model of the network comprises a local check graph, a minimal local check graph, and a minimal global check graph. (this limitation is merely directed to a field of use of check graphs, see MPEP 2106.05(h))
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 3 recites the additional limitation of:
The method of claim 2, wherein processing the network data to generate the local check graph comprises: generating a graph that represents the network, wherein nodes in the graph represent physical or virtual machines included in the network and edges between nodes represent respective connectivities between physical or virtual machines; assigning each node in the graph to a respective network zone of multiple network zones; and partitioning the graph into multiple disjoint subgraphs, wherein each disjoint subgraph corresponds to a respective network zone. (this limitation is merely directed to mental processes of organizing information into a graph, classifying nodes by zone, and partitioning the graph into subgraphs, which can reasonably be performed in the human mind or with the aid of pen and paper)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 4 recites the additional limitation of:
The method of claim 3, wherein processing the network data to generate the minimal local check graph comprises: identifying a minimum set of edges that connects all nodes in the graph; and removing edges from the local check graph that are not included in the minimum set of edges. (a mental process of identification and removal which can reasonable be performed in the human mind or with aid of pen and paper.)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 5 recites the additional limitation of:
The method of claim 3, wherein processing the network data to generate the minimal global check graph comprises: identifying edges that provide inter-zone connectivity between the nodes in the graph; and removing edges from the graph that are not included in the identified edges. (a mental process of identification and removal which can reasonable be performed in the human mind or with aid of pen and paper.)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 6 recites the additional limitation of:
The method of claim 1, … select one or more network verification mechanisms for the network comprises: encoding the data that represents invariant properties of the network and the multi-layer graph model of the network as quantum data; (a process of selecting and encoding, stated at a high level of generality, is being considered as a mental process of evaluation which can reasonably be performed in human mind or with aid of pen and paper)
applying a trained quantum circuit model to the quantum data to extract dominant features in the network data; and processing the dominant features in the network data using a trained classical machine learning model to select the network verification mechanisms. (applying/processing using a trained quantum circuit model or trained classical machine learning model, stated at a high level of generality, is being considered as mere instructions to apply an exception using generic computer components, see MPEP 2106.05(f))
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 7 recites the additional limitation of:
The method of claim 6, wherein encoding the data that represents invariant properties of the network and the multi-layer graph model of the network as quantum data comprises: generating a zone-centric relationship matrix, a data tier-centric relationship matrix, and a time window centric relationship matrix using the invariant properties of the network and the multi-layer graph model of the network; mapping the zone-centric relationship matrix, data tier-centric relationship matrix, and time window centric relationship matrix to a quantum circuit, wherein parameters of the quantum circuit correspond to entries of each of the zone-centric relationship matrix, data tier-centric relationship matrix, and time window centric relationship matrix; (a process of generating and mapping, stated at a high level of generality, is being considered as a mental process of evaluation which can reasonably be performed in human mind or with aid of pen and paper)
wherein processing the data that represents invariant properties of the network and the multi-layer graph model of the network using a quantum machine learning decision engine and applying the quantum circuit to a register of initialized qubits to prepare a quantum state that encodes the data that represents invariant properties of the network and the multi-layer graph model of the network. (applying a quantum circuit model, stated at a high level of generality, is being considered as mere instructions to apply an exception using generic computer components, see MPEP 2106.05(f))
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 8 recites the additional limitation of:
The method of claim 7, further comprising normalizing each of the zone-centric relationship matrix, data tier-centric relationship matrix, and time window centric relationship matrix, wherein the normalized zone-centric relationship matrix, data tier-centric relationship matrix, and time window centric relationship matrix are mapped to the quantum circuit. (normalizing, stated at a high level of generality, is being considered as a mental process of evaluation which can reasonably be performed in human mind or with aid of pen and paper)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 9 recites the additional limitation of:
The method of claim 6, wherein encoding the data that represents invariant properties of the network and the multi-layer graph model of the network as quantum data comprises: applying a quantum data encoding circuit to a register of initialized qubits to prepare a quantum state that encodes information included in the data that represents invariant properties of the network and the multi-layer graph model of the network, wherein the quantum data encoding circuit is determined based on the data that represents invariant properties of the network and the multi-layer graph model of the network. (a quantum data encoding circuit and initialized qubits are invoked, they merely use quantum-computing hardware as a tool to apply the exception using generic computer components, see MPEP 2106.05(f))
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 10 recites the additional limitation of:
The method of claim 6, wherein the quantum circuit model comprises a parameterized quantum circuit that has been configured through training to extract dominant features from a data input using a hybrid classical-quantum variational algorithm. (using a hybrid classical-quantum variational algorithm, stated at a high level of generality, is being considered as mere instructions to apply an exception using generic computer components, see MPEP 2106.05(f))
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 11 recites the additional limitation of:
The method of claim 1, wherein the data that represents invariant properties of the network is clustered in three dimensions, the dimensions comprising network zones, network data tiers, and network time windows. (this limitation is merely directed to mental processes of classifying and clustering information according to selected dimensions, which can reasonably be performed in the human mind or with the aid of pen and paper.)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 12 recites the additional limitation of:
The method of claim 1, wherein the invariant properties of the network are represented as knowledge graph, wherein vertices included in the knowledge graph represent network nodes, zones, network data tiers, or network connectivity in predefined time windows, and edges between vertices represent relationships between the vertices. (this limitation is merely directed to mental processes of organizing and correlating information in a graph representation)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 13 recites the additional limitation of:
The method of claim 1, wherein processing the network data to generate data that represents invariant properties of the network comprises: classifying nodes of the network as belonging to one of multiple network zones; classifying nodes of the network as belonging to one of multiple network data tiers; and identifying connectivity patterns of each node in the network with respect to multiple predefined time windows. (this limitation is merely directed to mental processes of classification, evaluation, and identification of patterns in information, which can reasonably be performed in the human mind or with the aid of pen and paper.)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 14 recites the additional limitation of:
processing data representing the classified nodes and identified connectivity patterns using a translational distance model to identify relationships between the classified nodes and identified connectivity patterns; (a translational distance model is invoked at a high level of generality, and is being considered merely as a tool to apply the exception, see MPEP 2106.05(f))
and generating a knowledge graph using the classified nodes, identified connectivity patterns, and relationships between the classified nodes and identified connectivity patterns, wherein vertices included in the knowledge graph represent network nodes, zones, data tiers, or time windows and edges between vertices represent relationships between the vertices. (this limitation is merely directed to mental processes of generating a knowledge graph, which can reasonably be performed in the human mind or with the aid of pen and paper.)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 15 recites the additional limitation of:
receiving network validation results of the live check of the network; (this limitation is merely directed to data gathering and is considered insignificant extra-solution activity under MPEP 2106.05(g); furthermore it should be noted that the courts have recognized receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information) as well-understood, routine, and conventional activity.)
inferring a network status using the selected network verification mechanisms; (this limitation is directed to a mental process because it merely evaluates results to form a judgment about status)
generating a network verification output that indicates whether problems or failures still exist in the network using the network validation results of the live check and the inferred network status; (this limitation is merely directed to outputting the result of the abstract evaluation and is considered insignificant post-solution activity under MPEP 2106.05(g); furthermore it should be noted that the courts have recognized receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information) as well-understood, routine, and conventional activity.)
and processing the network verification output to determine whether to initiate one or more remedial actions on the network. (this limitation is directed to a mental process because it merely evaluates the output to make a decision)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or non-obviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1, 6, 9-10, and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Ferriol-Galmés et al., (Ferriol-Galmés, M., Suárez-Varela, J., Paillissé, J., Shi, X., Xiao, S., Cheng, X., ... & Cabellos-Aparicio, A. (2022). Building a digital twin for network optimization using graph neural networks. Computer Networks, 217, 109329.), hereafter referred to as Ferriol, in view of Mari et al. (Mari, A., Bromley, T. R., Izaac, J., Schuld, M., & Killoran, N. (2020). Transfer learning in hybrid classical-quantum neural networks. Quantum, 4, 340.), hereafter referred to as Mari.
Claim 1: Ferriol teaches:
A method for verifying a network, the method comprising: obtaining, by a classical computer, network data from the network, wherein the network data comprises network monitoring data and network configuration data; (Ferriol, page 2, col. 1, paragraph 4, “In this paper, we present TwinNet, a Digital Twin that models the complex relationship between topology, routing, queue scheduling, and input traffic, in order to produce accurate estimates of per-flow QoS metrics (e.g., delay, jitter, loss). TwinNet is able to accurately estimate the delay in paths traversing arbitrary concatenations of queuing policies, with different routing configurations, traffic matrices, and network topologies.”
Ferriol, page 2, section 2, paragraph 2, “In this paper, we consider a Wide Area Network (WAN) that implements a classical SDN architecture: a centralized controller, and a southbound protocol that allows configuring the devices and collecting network performance metrics, such as OpenFlow or NETCONF (Fig. 1). … The controller has visibility of the local configuration of each data-plane element as well as up-to-date measurements of the network state: bandwidth, mean delay of each source–destination pair, and link utilization.”
Ferriol, page 3, col. 2, paragraph 1, “Particularly, the proposed Digital Twin (Fig. 2) is fed with a network state snapshot, defined by: (𝑖) a network topology, (𝑖𝑖) a src dst traffic matrix, and (𝑖𝑖𝑖) a routing and queueing policy.”, Ferriol teaches obtaining network data in the form of network topology, traffic matrix, routing and queueing policy inputs to the model, and separately identifies bandwidth, mean delay, and link utilization as up-to-date measurements of network state. Under Broadest Reasonable Interpretation (BRI), topology, routing policy, and queueing policy read on network configuration data, while bandwidth, mean delay, link utilization, and traffic matrix information read on network monitoring data. The claim’s “classical computer” is satisfied by Ferriol’s Digital Twin / GNN pipeline that takes those inputs and processes them computationally.)
processing, by the classical computer, the network data to generate data that represents invariant properties of the network; (Ferriol-Galmés, page 5, section 5.3, “We initialize the state of links hl, queues hq, and paths hp respectively with their initial feature vectors (xl, xq and xp), and apply zero-padding to fit the size of the target vectors, which is a configurable parameter of the GNN. After the message-passing phase, these hidden states are expected to encode some meaningful information about links (e.g., utilization), queues (e.g., load, packet loss rate), and paths (e.g., end-to-end delay, packet loss) based on the information exchanged along the graph.”, Ferriol processes the input network data to derive persistent structural/state information, including link utilization, queue load, packet loss rate, and end-to-end delay based on the graph exchanges among network components. Under BRI, those are “data that represents invariant properties of the network,” because they are not merely raw packets but higher-level network properties used to characterize the network and infer network behavior. The term invariant properties is reasonably read on stable structural/state features such as link, queue, and path conditions encoded by the model.)
processing, by the classical computer, the network data to generate a multi-layer graph model of the network; (Ferriol, page 5,, section 5.1, “TwinNet implements a novel and custom GNN architecture inspired by the inherent behavior of computer networks, where there are different components (e.g., forwarding devices, configuration, traffic) that interact with each other and have a complex non-linear impact on network performance. The model considers an input graph with three main network components: (i) the links that shape the network topology, i.e. connections between network devices, (ii) the queues on each output port of network devices, and (iii) the src-dst paths resulting from the input routing configuration. Each of these elements is explicitly represented in the GNN with n-element vectors that encode their hidden states (hl, hq, and hp respectively). They are combined through a message-passing algorithm that aims to capture the relation between the topology, traffic, routing and queueing policy of the input network scenario.”
Ferriol, page 6, section 5.4, “This custom GNN architecture is especially designed to solve the circular dependencies described in Eqs. (4), (5) and (6) by executing an iterative message-passing process. … This process is repeated T iterations …”, Ferriol teaches a multi-layer graph model because it first represents the network as an input graph having links, queues, and src-dst paths as graph components, and then processes that graph through an iterative message-passing GNN architecture. The graph satisfies use of a “graph model,” and the iterative message-passing architecture / repeated iterations satisfy the “multi-layer” aspect under BRI. Ferriol also explains that the graph contains network links, queues, and paths and captures relations among topology, traffic, routing, and queueing policy, so the model is expressly a graph model of the network.)
to select one or more network verification mechanisms for the network; (Ferriol, page 3, col. 1, paragraph 2, “Leveraging this information, the optimizer explores alternative configurations that can meet the SLA for the current traffic load. In TwinNet, configurations are combinations of source–destination routing and per-interface queuing configurations, i.e., scheduling algorithm and queue parameters. … Each configuration produced by the optimizer is tested by TwinNet, which produces fast and accurate estimates of flow delays. Once the optimizer finds a configuration that meets the SLAs, it is applied to the data-plane elements.”
Ferriol, page 2, col. 2, paragraph 3, “Optimization: Lastly, we pair TwinNet with an optimizer to find which routing and/or scheduling policies fulfill complex SLAs, with increasing traffic intensity.”, Ferriol teaches selecting which network-validation checks will be used by having the optimizer explore alternative routing and queueing configurations and find which routing and/or scheduling policies fulfill the SLA constraints. Under BRI, those selected routing and/or scheduling policies/configurations are the chosen network verification mechanisms, because they define the particular candidate network behaviors / policy scenarios that are tested and evaluated to verify network performance against SLA criteria.)
and initiating a live check of the network using the verification mechanisms to validate the network. (Ferriol, page 3, col. 1, paragraph 2, “Each configuration produced by the optimizer is tested by TwinNet, which produces fast and accurate estimates of flow delays. Once the optimizer finds a configuration that meets the SLAs, it is applied to the data-plane elements.”
Ferriol, page 2, col. 1, paragraph 7 “We also validate TwinNet with real-world packet traces, obtaining a MAPE of 7.2% and with data from a real testbed observing a MAPE of 6.3%.”, Ferriol expressly performs validation by testing configurations with TwinNet and separately validates the model with real-world packet traces, real traffic, and a real testbed. Ferriol identifies selected configurations for testing/validation, and carrying out that validation against real traffic.)
Mari, in the same field of , teaches the following limitations which Settles fails to teach:
processing, by a quantum computer, the data that represents invariant properties of the network and the multi-layer graph model of the network using a quantum machine learning decision engine (Mari, page 2, section 2.2, “One of the possible quantum generalizations of feed forward neural networks can be given in terms of variational quantum circuits [17, 24, 30, 30, 33, 34, 39, 41, 43]. Following the analogy with the classical case, one can define a quantum layer as a unitary operation which can be physically realized by a low-depth variational circuit acting on the input state |x⟩ of nq quantum subsystems (e.g., qubits or continuous variable modes) and producing the output state |y⟩: L : |x⟩ →|y⟩ = U(w)|x⟩, where w is an array of classical variational parameters… In order to inject classical data in a quantum network we need to embed a real vector x into a quantum state |x⟩. This can also be done by a variational embedding layer depending on x and applied to some reference state (e.g., the vacuum or ground state), E : x→|x⟩=E(x)|0⟩.”
Mari, page 3, section 2.3, “In order to apply transfer learning at the classical quantum interface, we need to connect classical neural networks to quantum variational circuits… With the aim of adding some basic pre-processing and post-processing of the input and output data we place a classical layer at the beginning and at the end of the quantum net work, obtaining what we might call a dressed quantum circuit:
PNG
media_image1.png
26
173
media_image1.png
Greyscale
”, Mari teaches the claimed quantum computer / quantum machine learning decision engine by disclosing variational quantum circuits operating on quantum subsystems (e.g., qubits), with a mechanism to embed a real vector into a quantum state and then process it through a dressed quantum circuit. That maps to processing classical network-derived data on a quantum processor using a quantum-ML engine. In the combination, Ferriol provides the network-derived data, and Mari provides the quantum-computing framework that processes such data.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have incorporated the teachings of Mari into Ferriol. A motivation to do so would have been to improve Ferriol’s machine-learning-based network failure evaluation and verification-selection workflow by using Mari’s hybrid classical-quantum architecture to better process Ferriol’s graph-derived network features. Mari expressly teaches that hybrid transfer learning is attractive because it allows one to “embed a select set of highly informative features into a quantum processor,” (Mari, abstract) which would have suggested using Mari’s variational-quantum / dressed-circuit techniques to process the informative network-state and graph-model features already produced in Ferriol’s robust network design framework. Doing so would have been a predictable use of known quantum-ML feature processing to enhance an existing ML-based network-analysis pipeline, with a reasonable expectation of success because Ferriol already starts from structured network features and Mari expressly teaches integrating classical preprocessing with quantum post-processing.
Claim 6: Ferriol and Mari teaches the limitations of claim 1, Mari further teaches:
The method of claim 1, wherein processing the data that represents invariant properties of the network and the multi-layer graph model of the network using a quantum machine learning decision engine to select one or more network verification mechanisms for the network comprises: encoding the data that represents invariant properties of the network and the multi-layer graph model of the network as quantum data; (Mari, page 2, section 2.2, “One of the possible quantum generalizations of feed forward neural networks can be given in terms of variational quantum circuits [17, 24, 30, 30, 33, 34, 39, 41, 43]. Following the analogy with the classical case, one can define a quantum layer as a unitary operation which can be physically realized by a low-depth variational circuit acting on the input state |x⟩ of nq quantum subsystems (e.g., qubits or continuous variable modes) and producing the output state |y⟩: L : |x⟩ →|y⟩ = U(w)|x⟩, where w is an array of classical variational parameters… In order to inject classical data in a quantum network we need to embed a real vector x into a quantum state |x⟩. This can also be done by a variational embedding layer depending on x and applied to some reference state (e.g., the vacuum or ground state), E : x→|x⟩=E(x)|0⟩.”, Mari expressly teaches encoding classical input data as quantum data by teaching that one must “embed a real vector” into a quantum state through an embedding map applied to a reference state.)
applying a trained quantum circuit model to the quantum data to extract dominant features in the network data; (Mari, page 4, section 3.2, “In this case a pre-trained quantum system behaves as a kind of feature extractor, i.e., a de vice performing a (potentially classically intractable) computation resulting in an output vector of numerical values associated to the input.”
Mari, page 5, col. 1, paragraph 3, “For case (ii) instead, one can envisage a multi-party scenario in which many classical clients B can independently send samples of their specific datasets to a common quantum server A which is pre-trained to ex tract generic features by performing a fixed quantum computation.”, Mari teaches using a trained quantum-network component as a feature extractor, explaining that a pre-trained network can be truncated and used to produce features that are more generic. This reads on applying a trained quantum circuit model to encoded data to extract useful or dominant features.)
and processing the dominant features in the network data using a trained classical machine learning model (Mari, page 4, col. 1, paragraph 1, “Generic transfer learning scheme (see Fig. 1): 1. Take a network A that has been pre-trained on a dataset DA and for a given task TA. 2. Remove some of the final layers. In this way, the resulting truncated network A′ can be used as a feature extractor. 3. Connect a new trainable network B at the end of the pre-trained network A′. 4. Keep the weights of A′ constant, and train the final block B with a new dataset DB and for a new task of interest TB.”
Mari, page 5, section 3.3, “In this case a quantum network A is pre-trained for a generic task and dataset. Successively, some of the final quantum layers are removed, and replaced by a trainable quantum network B which will be optimized for a specific problem.”
Mari, page 8, col. 2, last paragraph, “In order to tackle this problem, we apply a QC transfer learning approach: we pre-process our random input states with the quantum network of Ref. [24] and we consider the corresponding images as features which we are going to post-process with a classical layer to predict the state label j. In simple terms, the QC trans fer learning method allows us to convert a quantum state classification problem into an image classification problem.”, Mari teaches a trained classical machine learning model by disclosing classical layers at the quantum interface and a trainable network B connected after a feature extractor. That is a direct read on processing extracted features using a trained classical model. The “dominant features” are the extracted intermediate representations, and the “trained classical machine learning model” is Mari’s classical downstream block / post-processing network.)
Ferriol further teaches:
to select the network verification mechanisms. (Ferriol, page 3, col. 1, paragraph 2, “Leveraging this information, the optimizer explores alternative configurations that can meet the SLA for the current traffic load. In TwinNet, configurations are combinations of source–destination routing and per-interface queuing configurations, i.e., scheduling algorithm and queue parameters. … Each configuration produced by the optimizer is tested by TwinNet, which produces fast and accurate estimates of flow delays. Once the optimizer finds a configuration that meets the SLAs, it is applied to the data-plane elements.”
Ferriol, page 2, col. 2, paragraph 3, “Optimization: Lastly, we pair TwinNet with an optimizer to find which routing and/or scheduling policies fulfill complex SLAs, with increasing traffic intensity.”, Ferriol teaches selecting which network-validation checks will be used by having the optimizer explore alternative routing and queueing configurations and find which routing and/or scheduling policies fulfill the SLA constraints. Under BRI, those selected routing and/or scheduling policies/configurations are the chosen network verification mechanisms, because they define the particular candidate network behaviors / policy scenarios that are tested and evaluated to verify network performance against SLA criteria.)
Claim 9: Ferriol and Mari teaches the limitations of claim 1, Mari further teaches:
The method of claim 6, wherein encoding the data that represents invariant properties of the network and the multi-layer graph model of the network as quantum data comprises: applying a quantum data encoding circuit to a register of initialized qubits to prepare a quantum state that encodes information included in the data that represents invariant properties of the network and the multi-layer graph model of the network, (Mari, page 2, section 2.2, “One of the possible quantum generalizations of feed forward neural networks can be given in terms of variational quantum circuits [17, 24, 30, 30, 33, 34, 39, 41, 43]. Following the analogy with the classical case, one can define a quantum layer as a unitary operation which can be physically realized by a low-depth variational circuit acting on the input state |x⟩ of nq quantum subsystems (e.g., qubits or continuous variable modes) and producing the output state |y⟩: L : |x⟩ →|y⟩ = U(w)|x⟩, where w is an array of classical variational parameters… In order to inject classical data in a quantum network we need to embed a real vector x into a quantum state |x⟩. This can also be done by a variational embedding layer depending on x and applied to some reference state (e.g., the vacuum or ground state), E : x→|x⟩=E(x)|0⟩.”, Mari expressly teaches an encoding layer that maps a classical vector into a quantum state using an embedding map applied to a reference state, written as E.)
wherein the quantum data encoding circuit is determined based on the data that represents invariant properties of the network and the multi-layer graph model of the network. (Mari, page 2, section 2.2, “One of the possible quantum generalizations of feed forward neural networks can be given in terms of variational quantum circuits [17, 24, 30, 30, 33, 34, 39, 41, 43]. Following the analogy with the classical case, one can define a quantum layer as a unitary operation which can be physically realized by a low-depth variational circuit acting on the input state |x⟩ of nq quantum subsystems (e.g., qubits or continuous variable modes) and producing the output state |y⟩: L : |x⟩ →|y⟩ = U(w)|x⟩, where w is an array of classical variational parameters… In order to inject classical data in a quantum network we need to embed a real vector x into a quantum state |x⟩. This can also be done by a variational embedding layer depending on x and applied to some reference state (e.g., the vacuum or ground state), E : x→|x⟩=E(x)|0⟩.”, Mari teaches that the embedding layer is a variational embedding layer depending on x, i.e., depending on the input data. That directly reads on the claim that the encoding circuit is determined based on the input data being encoded.)
Claim 10: Ferriol and Mari teaches the limitations of claim 1, Mari further teaches:
The method of claim 6, wherein the quantum circuit model comprises a parameterized quantum circuit (Mari, page 2, section 2.2, “Following the analogy with the classical case, one can define a quantum layer as a unitary operation which can be physically realized by a low-depth variational circuit acting on the input state |x⟩ of nq quantum subsystems (e.g., qubits or continuous variable modes) and producing the output state |y⟩: L : |x⟩ →|y⟩ = U(w)|x⟩,… A variational quantum circuit of depth q is a con catenation of many quantum layers, corresponding to the product of many unitaries parametrized by different weights: Q=Lq◦...L2 ◦L1.”, Mari expressly teaches a quantum layer defined by U(w), where w is an array of classical variational parameters, and further teaches a variational quantum circuit as a concatenation of unitaries “parametrized by different weights.” That directly maps to the claim’s parameterized quantum circuit.)
that has been configured through training (Mari, page 4, col. 1, paragraph 1, “Generic transfer learning scheme (see Fig. 1): 1. Take a network A that has been pre-trained on a dataset DA and for a given task TA. 2. Remove some of the final layers. In this way, the resulting truncated network A′ can be used as a feature extractor. 3. Connect a new trainable network B at the end of the pre-trained network A′. 4. Keep the weights of A′ constant, and train the final block B with a new dataset DB and for a new task of interest TB.”
Mari, page 5, section 3.3, “In this case a quantum network A is pre-trained for a generic task and dataset. Successively, some of the final quantum layers are removed, and replaced by a trainable quantum network B which will be optimized for a specific problem.”, Mari teaches training explicitly, both for classical weights and for the transfer-learning framework using a pre-trained network and a downstream trainable network B. That is sufficient to teach that the quantum/classical hybrid model is configured through training. )
to extract dominant features from a data input using a hybrid classical-quantum variational algorithm. (Mari, page 6, example 2, “In this second example we apply the classical-to quantum transfer learning scheme for solving an image classification problem. We first numerically trained and tested the model, using PennyLane with the PyTorch [32] interface. Successively, we have also run it on two real quantum devices provided by IBM and Rigetti. To our knowledge, this is the first time that high resolution images have been classified with a hybrid classical-quantum system.”,
Mari, page 4, section 3.2, “In this case a pre-trained quantum system behaves as a kind of feature extractor, i.e., a de vice performing a (potentially classically intractable) computation resulting in an output vector of numerical values associated to the input.”
Mari, page 5, col. 1, paragraph 3, “For case (ii) instead, one can envisage a multi-party scenario in which many classical clients B can independently send samples of their specific datasets to a common quantum server A which is pre-trained to ex tract generic features by performing a fixed quantum computation.”, Mari teaches a hybrid classical-quantum arrangement at the “classical-quantum interface,” built around variational quantum circuits, and separately teaches use of a pre-trained network as a feature extractor. Taken together, that reads on using a hybrid classical-quantum variational algorithm to extract dominant features from input data. The “dominant features” are the extracted intermediate representations used for downstream learning/decision.)
Claim 16 recites limitations substantially similar to claim 1, as such a similar analysis applies.
Claim 2 is rejected under 35 U.S.C. 103 as being unpatentable over Ferriol in view of Mari, Javed et al. (Javed, Y., Felemban, M., Shawly, T., Kobes, J., & Ghafoor, A. (2020). A partition-driven integrated security architecture for cyberphysical systems. Computer, 53(3), 47-56.), hereafter referred to as Javed, and Carnegie Mellon University (Minimum spanning trees. (2015, April 29). In 15-210: Parallel and sequential data structures and algorithms (Chapter 18). Carnegie Mellon University.), hereafter referred to as CMU.
Claim 2: Ferriol and Mari teaches the limitations of claim 1, Javed, in the same field of graph based partitioning further teaches the following which Ferriol and Mari fail to teach:
PNG
media_image2.png
405
569
media_image2.png
Greyscale
Figure 2 of Javed
The method of claim 1, wherein the multi-layer graph model of the network comprises a local check graph, (Javed, page 6, figure 2, “Figure 2. Partitioning process for AMI. (a) Multi-layered system of systems AMI architecture. (b) Demarcation of IBs on a given AMI topology. (c) AMI topological structure in an IB. (d) Partitioning of the AMI topological structure to form protection zones.”, Javed teaches a graph-based local partition of the overall system by using the CPS topological structure and partitioning it into protection-zones. Each such zone-level partition is a local check graph, i.e., a graph abstraction used to localize checking/containment within a bounded portion of the larger network graph. )
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have incorporated the teachings of Javed into the combination of Ferriol and Mari. A motivation to do so would have been to introduce partition-based, localized graph checking into Ferriol’s network-verification workflow so that the verification process could be organized into local and global portions rather than treating the entire network as a monolithic graph. Javed expressly teaches a security architecture that “localizes the cyber-attack in a timely manner” (Javed, abstract) and partitions the protected system to contain propagation effects, which would have suggested structuring Ferriol’s graph-based network verification around local partitions / zones to improve containment, localization, and modular checking. A skilled artisan would have found it obvious to use Javed’s partition-driven approach with Ferriol’s ML-based graph analysis and Mari’s hybrid quantum/classical decision engine to obtain local-check graph abstractions within the broader verification framework.
CMU, in the same field of network graph partitioning, teaches the following which Ferriol, Mari, and Javed fail to teach:
a minimal… graph, (CMU, page 316, definition 18.5, “Definition 18.5. Given a connected, undirected weighted graph G = (V,E,w), the minimum (weight) spanning tree (MST) problem requires finding a spanning tree of minimum weight, where the weight of a tree T is defined as:
PNG
media_image3.png
48
136
media_image3.png
Greyscale
”,
CMU, page 325, paragraph 1, “the partitions are defined by general trees and thus we want to contract trees. By removing all edges that are not vertex joiners, we can contract a partition by applying star contraction to the partition.”, CMU teaches how that already-local graph is made minimal: a connected graph is reduced to a minimum spanning tree, i.e., a smallest connecting edge set that still spans the vertices, and, within a partition, “all edges that are not vertex joiners” are removed so that only the tree structure remains. It should be noted that, in the combination, Javed provides the local check graph, and CMU teaches the minimal version of that same local graph.)
and a minimal global check graph. (CMU, page 323, paragraph 1, “The edges that cross the partitions, however, must be considered as they can indeed be in the MST. One way to eliminate the internal edges from consideration, while keeping the cross edges is to perform a graph contraction based on the partitioning defined by the vertex joiners. Recall that in graph contraction, all we need is a partitioning of the graph into disjoint connected subgraphs. Given such a partitioning, we then replace each subgraph (partition) with a supervertex and relabel the edges. This is repeated until no edges remain.”,
CMU, page 323, paragraph 4, “For the purposes of MST, in particular, we can keep all the edges or keep just the edge with the minimum weight, because the others, cannot be in the MST.”, CMU teaches a global graph because each partition is replaced with a supervertex, so the resulting graph is no longer the internal local graph of a single partition, but an inter-partition graph that captures how the partitions relate to each other. It is minimal because the internal edges are expressly eliminated and, among redundant cross-partition edges, only the minimum-weight edge need be kept. Thus, CMU teaches the minimized inter-zone graph used for checking global connectivity between those zones.)
It would have been further obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have incorporated the teachings of CMU into the combination of Ferriol, Mari, and Javed. A motivation to do so would have been to reduce the complexity and overhead of the partitioned graph structures while still preserving connectivity needed for verification. CMU teaches that a minimum spanning tree “spans the graph while minimizing the total weight,” (CMU, page 1, paragraph 1) which would have suggested reducing Javed’s partitioned/local graph structures to minimum connecting edge sets so that verification could be performed more efficiently on a reduced graph while still maintaining the necessary connected structure. Applying MST-based reduction to the partitioned graphs would have been a routine graph-optimization measure to improve efficiency in Ferriol’s already computationally focused ML verification framework.
Claims 3-5 are rejected under 35 U.S.C. 103 as being unpatentable over Ferriol in view of Mari, Javed, CMU, and Ramasamy et al., (Ramasamy, H. V., Tsao, C. L., Pfitzmann, B., Joukov, N., & Murray, J. W. (2011). Towards automated identification of security zone classification in enterprise networks. In Workshop on Hot Topics in Management of Internet, Cloud, and Enterprise Networks and Services (Hot-ICE 11).), hereafter referred to as Ramasamy.
Claim 3: Ferriol, Mari, Javed, and CMU teaches the limitations of claim 2, Javed further teaches:
The method of claim 2, wherein processing the network data to generate the local check graph comprises: generating a graph that represents the network, (Javed, page 9, paragraph 2, “In order to simulate this scenario we have used SecAMI11, an opensource simulator developed to study the impact of cyber-attacks on AMI. SecAMI can be used to perform two operations: first an AMI topology involving smart meters and data concentrators can be created as an undirected graph,”, Javed expressly teaches creating the system topology as an undirected graph. That teaches generating a graph representation of the network.)
and partitioning the graph into multiple disjoint subgraphs, wherein each disjoint subgraph corresponds to a respective network zone. (Javed, page 6, figure 2, “Figure 2. Partitioning process for AMI. (a) Multi-layered system of systems AMI architecture. (b) Demarcation of IBs on a given AMI topology. (c) AMI topological structure in an IB. (d) Partitioning of the AMI topological structure to form protection zones.”, Javed teaches partitioning the topology into multiple protection-zones, i.e., disjoint graph partitions used for localized isolation and containment. Under BRI, those protection-zone partitions correspond to the claimed disjoint subgraphs, each associated with a particular zone.)
Ramasamy, in the same field of graph based partitioning further teaches the following which Ferriol, Mari, Javed, and CMU fail to teach:
wherein nodes in the graph represent physical or virtual machines included in the network (Ramasamy, page 1, section 1, “The network infrastructure of a modern enterprise is a complex system partitioned by enterprise firewalls into several logical network areas, called security zones. In formally, a security zone consists of one or more subnets. Each security zone belongs to a zone classification (or simply, classification), and consists of devices1 subject to the same enterprise-level security requirements… Unless specified, we use the term device in a broad sense to cover computing, network, and storage devices, both physical and virtual.”, Ramasamy expressly states that the term device broadly covers both physical and virtual devices.)
and edges between nodes represent respective connectivities between physical or virtual machines; (Ramasamy, page 3, section 2.2, paragraph 3, “Let N(ai,aj) be the feasibility set of actually allowed network flows from area ai to aj as indicated by data from various collection methods. Let P(ci,cj) be the feasibility set of packets from an area of color ci to another of color cj that are permitted by the security policy.”,
Ramasamy, page 5, col. 1, paragraph 2, “The edges are labeled with the types of network f lows observed between each pair of nodes. For instance, Flow Type X was observed between a1 and a2.”, Ramasamy represents network relationships in terms of actually allowed network flows between devices/network areas. Under BRI, those allowed flows are the claimed graph edges representing connectivity between nodes. )
assigning each node in the graph to a respective network zone of multiple network zones; (Ramasamy, page 3, section 2.1, “Network area is an intermediate construct we use in the process of deriving security zones in a network environment and identifying their classifications. A network area may consist of a device or a grouping of logically adjacent devices (such as subnet). A security zone is composed of one or more subnets.”, Ramasamy teaches assigning enterprise devices/network areas to security zones and deriving their classification. That directly teaches assigning each node/device to a respective network zone.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have incorporated the teachings of Ramasamy into the combination of Ferriol, Mari, Javed, and CMU. A motivation to do so would have been to provide a concrete, network-specific basis for assigning devices/nodes to security zones and for deriving inter-node / inter-zone connectivity information from actual enterprise-network evidence. Ramasamy expressly teaches a “semi-automated approach for discovering security zone information” (Ramasamy, abstract) and further explains that “configuration alone is not sufficient” (Ramasamy, page 2, col. 1, paragraph 3) for reliable zone classification, which would have suggested enriching the partitioned graph approach of Javed and the reduced graph structures from CMU with real network-zone classifications and connectivity evidence from enterprise configurations, logs, probes, and flows. A skilled artisan would therefore have been motivated to use Ramasamy to ground the local/global graph abstractions in actual network zones and actual allowed connectivity, thereby making the combined Ferriol/Mari/Javed/CMU framework better suited to network verification.
Claim 4: Ferriol, Mari, Javed, CMU, and Ramasamy teaches the limitations of claim 3, CMU further teaches:
The method of claim 3, wherein processing the network data to generate the minimal local check graph comprises: identifying a minimum set of edges that connects all nodes in the graph; a minimal local check graph, (CMU, page 316, definition 18.5, “Definition 18.5. Given a connected, undirected weighted graph G = (V,E,w), the minimum (weight) spanning tree (MST) problem requires finding a spanning tree of minimum weight, where the weight of a tree T is defined as:
PNG
media_image3.png
48
136
media_image3.png
Greyscale
”, CMU defines the minimum spanning tree as a spanning tree of minimum weight, i.e., a minimum edge set that still connects all graph vertices. That directly teaches identifying a minimum set of edges connecting all nodes.)
and removing edges from the local check graph that are not included in the minimum set of edges. (CMU, page 323, paragraph 1, “To see how we can proceed, note that the vertex joiners define a partitoning of the graph—all the vertices are in a partition. Consider now the edges that remain internal to a partition. Such an edge is cannot be in the MST, because inserting it into the MST would create a cycle… One way to eliminate the internal edges from consideration, while keeping the cross edges is to perform a graph contraction based on the partitioning defined by the vertex joiners. Recall that in graph contraction, all we need is a partitioning of the graph into disjoint connected subgraphs. Given such a partitioning, we then replace each subgraph (partition) with a supervertex and relabel the edges. This is repeated until no edges remain”, CMU teaches that edges not belonging to the selected spanning-tree structure, such as edges that remain internal to a partition and would create cycles, cannot be in the MST. That teaches removing edges not included in the selected minimum set from the local graph.)
Claim 5: Ferriol, Mari, Javed, CMU, and Ramasamy teaches the limitations of claim 3, Javed further teaches:
The method of claim 3, wherein processing the network data to generate the minimal global check graph comprises: identifying edges that provide inter-zone connectivity between the nodes in the graph; (Javed, page 4, paragraph 3, “The CPS components in an IB and the interconnections among them can be modeled as an unweighted non-directional graph 𝑃, as shown in Figure 2(c). Let 𝑃 = {𝑉,𝐸} where 𝑉 is the set of vertices modeling CPS components and 𝐸 is the set of edges modeling the communication links between CPS components.”
Javed, page 5, paragraph 1, “The intuition is that, if a component that is connected to components in many different protection-zones is attacked then damage could quickly propagate to other protection-zones… PAM maintains information about the respective member components of protection zones and the boundary components of all protection-zones. A CPS component that has connections to components in other protection-zones is a boundary component.”, Javed expressly identifies boundary components as components having connections to components in other protection-zones. Those are the claimed inter-zone connectivity edges, because they are exactly the connections that cross from one partition/zone to another.)
CMU further teaches:
and removing edges from the graph that are not included in the identified edges. (CMU, page 323, paragraph 1, “To see how we can proceed, note that the vertex joiners define a partitoning of the graph—all the vertices are in a partition. Consider now the edges that remain internal to a partition. Such an edge is cannot be in the MST, because inserting it into the MST would create a cycle… One way to eliminate the internal edges from consideration, while keeping the cross edges is to perform a graph contraction based on the partitioning defined by the vertex joiners. Recall that in graph contraction, all we need is a partitioning of the graph into disjoint connected subgraphs. Given such a partitioning, we then replace each subgraph (partition) with a supervertex and relabel the edges. This is repeated until no edges remain”, CMU teaches preserving edges that cross the partitions while treating edges internal to a partition as removable for the contracted/global abstraction. That teaches removing non-inter-zone edges and retaining only the identified inter-zone connectivity edges in the minimal global graph.)
Claims 7-8 are rejected under 35 U.S.C. 103 as being unpatentable over Ferriol in view of Mari, Pang et al., (Pang, W., Panda, S., Amjad, J., Diot, C., & Govindan, R. (2022). {CloudCluster}: Unearthing the functional structure of a cloud service. In 19th USENIX Symposium on Networked Systems Design and Implementation (NSDI 22) (pp. 1213-1230).), hereafter referred to as Pang, and Mitarai et al., (Mitarai, K., Negoro, M., Kitagawa, M., & Fujii, K. (2019). Quantum circuit learning. Physical Review A, 98(3), 032309.), hereafter referred to as Mitarai.
Claim 7: Ferriol and Mari teaches the limitations of claim 6, Pang, in the same field of cloud computing and clustering further teaches the following which Ferriol and Mari fail to teach:
The method of claim 6, wherein encoding the data that represents invariant properties of the network and the multi-layer graph model of the network as quantum data comprises: generating a zone-centric relationship matrix, (Pang, page 1218, section 4, “The goal of the evaluation is to demonstrate that CloudCluster produces clusters that are consistent with VMs grouped by location and function. In other words, in each cluster, all VMs are in the same zone, and perform the same function.”
Pang, page 1218, col. 1, paragraph 1, “The dataset includes projects of VMs with various type of workloads (e.g., web servers, load balancers, image transcoders, key-value stores etc.). It includes projects that are internal to Google and those belonging to external customers. Each traffic matrix in the dataset contains uniformly sampled VM-to-VM traffic aggregated over a 1-hour window.”, Pang teaches a VM-to-VM traffic matrix and expressly uses zone information to interpret/organize the resulting clusters. Under BRI, organizing those traffic relationships by zone yields the claimed zone-centric relationship matrix.)
a data tier-centric relationship matrix, (Pang, page 1216, col. 1, paragraph 1, “Challenge: Scale. Y can be large, since projects can have tens of thousands of VMs. We have observed, through manual inspection of cloud projects, that to enable projects to scale, designers often group VMs that perform similar functions. At the front-end, load-balancers redirect requests to VMs that scale with the request load; all these VMs perform the same function (e.g., handle requests). In turn, at the back-end, these VMs may invoke other services that may be replicated across several identical VMs, or may send the request to a coordinator VM that invokes an iterative distributed computation spread across several identical VMs. Such structures result in VM groupings.”
Pang, page 219, col. 1, last paragraph, “Moreover, CloudCluster can handle projects with varying functional and geographical diversity. Projects A, B, E and F each run more than 20 different kinds of software and span across a number of zones across the globe. This also explains why they have many clusters (recall that clusters are distinguished both by function and location).”, Pang groups VMs by function and location, with examples such as front-end/load-balancer and backend/service roles. Under BRI, those function-based groups are the claimed data tiers, and the traffic relationships among them form the claimed data tier-centric relationship matrix.)
and a time window centric relationship matrix using the invariant properties of the network and the multi-layer graph model of the network; (Pang, page 1215, section 3.1, “Notation. The input to CloudCluster is a VM-to-VM traffic matrix for a cloud project, containing traffic volumes between each VM over a fixed aggregation window.4 Traffic volumes are obtained by sampling flows. In §4, we discuss the actual values of the aggregation window and the sampling frequency.”,
Pang, page 1218, col. 1, paragraph 1, “The dataset includes projects of VMs with various type of workloads (e.g., web servers, load balancers, image transcoders, key-value stores etc.). It includes projects that are internal to Google and those belonging to external customers. Each traffic matrix in the dataset contains uniformly sampled VM-to-VM traffic aggregated over a 1-hour window.”, Pang expressly builds the traffic matrix over a fixed aggregation window, and the evaluated matrices are aggregated over a 1-hour window. That directly teaches a relationship matrix centered on a predefined time window.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have incorporated the teachings of Pang into the combination of Ferriol and Mari. A motivation to do so would have been to derive structured zone-, function/tier-, and time-window-based relationship data from network traffic so that Ferriol’s graph-based network state could be expressed in a form more amenable to clustering, abstraction, and downstream ML/QML processing. Pang teaches that clustered communication structure can serve as a “useful abstraction” (Pang, page 1214, col. 2, paragraph 3) and can “identify anomalous traffic and potential misconfigurations,” (Pang, abstract) which would have suggested using Pang’s traffic-matrix and clustering techniques to organize Ferriol’s network inputs into higher-level relational matrices and multi-dimensional groupings for more efficient verification and feature extraction. This would have predictably improved the interpretability and structure of the data fed into the Ferriol/Mari verification pipeline.
Mitarai, in the same field of cloud computing and clustering further teaches the following which Ferriol, Mari, and Pang fail to teach:
mapping the zone-centric relationship matrix, data tier-centric relationship matrix, and time window centric relationship matrix to a quantum circuit, wherein parameters of the quantum circuit correspond to entries of each of the zone-centric relationship matrix, data tier-centric relationship matrix, and time window centric relationship matrix; (Mitarai, page 2, col. 1, paragraph 1, “1. Encode input data {xi} into some quantum state |ψin(xi) by applying a unitary input gate U(xi) to initialized qubits |0
2. Apply a θ-parameterized unitary U(θ) to the input state and generate an output state |ψout(xi,θ) = U(θ)|ψin(xi).”, Mitarai teaches encoding classical inputs by applying an input unitary U(xi) and then applying a θ-parameterized unitary. Pang supplies the three claimed matrices, and those matrices are what are being interpreted here as the classical input data {xi} of Mitarai. More specifically, the entries of the zone-centric relationship matrix, data tier-centric relationship matrix, and time window centric relationship matrix collectively form the classical feature values of xi that determine the input gate U(xi). Thus, Mitarai teaches mapping Pang’s matrix-derived classical data to a quantum circuit whose effective encoding is determined by those matrix entries.)
and applying the quantum circuit to a register of initialized qubits to prepare a quantum state that encodes the data that represents invariant properties of the network and the multi-layer graph model of the network. (Mitarai, page 2, col. 1, paragraph 1, “1. Encode input data {xi} into some quantum state |ψin(xi) by applying a unitary input gate U(xi) to initialized qubits |0
2. Apply a θ-parameterized unitary U(θ) to the input state and generate an output state |ψout(xi,θ) = U(θ)|ψin(xi).”, Mitarai expressly teaches applying the input gate to initialized qubits to prepare the input quantum state. That directly reads on applying the quantum circuit to a register of initialized qubits to prepare a quantum state encoding the matrix-derived data.)
It would have been further obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have incorporated the teachings of Mitarai into the combination of Ferriol, Mari, and Pang. A motivation to do so would have been to provide a specific and well-understood mechanism for encoding Pang’s structured classical relationship data into a trainable quantum circuit within the Ferriol/Mari hybrid-QML framework. Mitarai expressly proposes a “classical-quantum hybrid algorithm” in which the circuit learns by “tuning parameters implemented on it,” (Mitarai, abstract) which would have suggested using Mitarai’s quantum-circuit-learning technique as the concrete encoding and training mechanism for the zone-/tier-/time-window relationship matrices and other structured network features produced from Ferriol and Pang. A skilled artisan would have viewed this as a predictable substitution or supplementation of one known QML implementation (Mitarai) into another hybrid quantum/classical context (Mari) to improve encoding and trainable circuit design for the same type of learned decision task.
Claim 8: Ferriol, Mari, Pang, and Mitarai teaches the limitations of claim 7, Pang further teaches:
The method of claim 7, further comprising normalizing each of the zone-centric relationship matrix, data tier-centric relationship matrix, and time window centric relationship matrix, (Pang, page 1216, section 3.2, paragraph 1, “Each row of Y can be treated as a (high-dimensional) feature… Feature scaling normalizes the range of each fea ture to enable clustering algorithms to be robust to highly vari able traffic volumes. Of the existing feature scaling method ologies, standardization and minmax scaling cannot handle the range of traffic volumes we see in cloudprojects.”,
Pang, page 1216, algorithm 1, “scaled_Y = feature_scaling(Y);”, Pang expressly treats the input traffic matrix Y as feature data and then applies feature_scaling(Y) so that the matrix values are normalized before further processing. Under BRI, once the traffic relationships are organized into the claimed zone-centric, data-tier-centric, and time-window-centric matrix views, Pang’s same feature-scaling / log-scaling step teaches normalizing the values of those matrices before downstream clustering and encoding.)
Mitarai further teaches:
wherein the normalized zone-centric relationship matrix, data tier-centric relationship matrix, and time window centric relationship matrix are mapped to the quantum circuit. (Mitarai, page 2, col. 1, paragraph 1, “1. Encode input data {xi} into some quantum state |ψin(xi) by applying a unitary input gate U(xi) to initialized qubits |0
2. Apply a θ-parameterized unitary U(θ) to the input state and generate an output state |ψout(xi,θ) = U(θ)|ψin(xi).”, Mitarai teaches that the input data are then encoded into the quantum circuit. In the combination, Pang’s scaled_Y / normalized matrix data are the classical input data {xi} that are supplied to Mitarai’s input gate U(xi). Thus, what is being mapped to the quantum circuit are the normalized matrix values generated by Pang, i.e., the normalized zone-centric, data-tier-centric, and time-window-centric relationship data after feature scaling.)
Claims 11 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over Ferriol in view of Mari and Pang.
Claim 11: Ferriol and Mari teaches the limitations of claim 1, Pang, in the same field of cloud computing, further teaches the following which Ferriol and Mari fail to teach:
The method of claim 1, wherein the data that represents invariant properties of the network is clustered in three dimensions, the dimensions comprising network zones, (Pang, page 1218, section 4, “The goal of the evaluation is to demonstrate that CloudCluster produces clusters that are consistent with VMs grouped by location and function. In other words, in each cluster, all VMs are in the same zone, and perform the same function.”
Pang, page 1218, col. 1, paragraph 1, “The dataset includes projects of VMs with various type of workloads (e.g., web servers, load balancers, image transcoders, key-value stores etc.). It includes projects that are internal to Google and those belonging to external customers. Each traffic matrix in the dataset contains uniformly sampled VM-to-VM traffic aggregated over a 1-hour window.”, Pang teaches a VM-to-VM traffic matrix and expressly uses zone information to interpret/organize the resulting clusters. Under BRI, organizing those traffic relationships by zone yields the claimed zone-centric relationship matrix.)
network data tiers, (Pang, page 1216, col. 1, paragraph 1, “Challenge: Scale. Y can be large, since projects can have tens of thousands of VMs. We have observed, through manual inspection of cloud projects, that to enable projects to scale, designers often group VMs that perform similar functions. At the front-end, load-balancers redirect requests to VMs that scale with the request load; all these VMs perform the same function (e.g., handle requests). In turn, at the back-end, these VMs may invoke other services that may be replicated across several identical VMs, or may send the request to a coordinator VM that invokes an iterative distributed computation spread across several identical VMs. Such structures result in VM groupings.”
Pang, page 219, col. 1, last paragraph, “Moreover, CloudCluster can handle projects with varying functional and geographical diversity. Projects A, B, E and F each run more than 20 different kinds of software and span across a number of zones across the globe. This also explains why they have many clusters (recall that clusters are distinguished both by function and location).”, Pang groups VMs by function and location, with examples such as front-end/load-balancer and backend/service roles. Under BRI, those function-based groups are the claimed data tiers, and the traffic relationships among them form the claimed data tier-centric relationship matrix.)
and network time windows. (Pang, page 1215, section 3.1, “Notation. The input to CloudCluster is a VM-to-VM traffic matrix for a cloud project, containing traffic volumes between each VM over a fixed aggregation window.4 Traffic volumes are obtained by sampling flows. In §4, we discuss the actual values of the aggregation window and the sampling frequency.”,
Pang, page 1218, col. 1, paragraph 1, “The dataset includes projects of VMs with various type of workloads (e.g., web servers, load balancers, image transcoders, key-value stores etc.). It includes projects that are internal to Google and those belonging to external customers. Each traffic matrix in the dataset contains uniformly sampled VM-to-VM traffic aggregated over a 1-hour window.”, Pang expressly builds the traffic matrix over a fixed aggregation window, and the evaluated matrices are aggregated over a 1-hour window. That directly teaches a relationship matrix centered on a predefined time window.)
The rationale for combining Ferriol and Mari with Pang is similar to that applied for claim 7 above.
Claim 13: Ferriol and Mari teaches the limitations of claim 1, Pang, in the same field of cloud computing, further teaches the following which Ferriol and Mari fail to teach:
The method of claim 1, wherein processing the network data to generate data that represents invariant properties of the network comprises: classifying nodes of the network as belonging to one of multiple network zones; (Pang, page 1218, section 4, “The goal of the evaluation is to demonstrate that CloudCluster produces clusters that are consistent with VMs grouped by location and function. In other words, in each cluster, all VMs are in the same zone, and perform the same function.”
Pang, page 1218, col. 1, paragraph 1, “The dataset includes projects of VMs with various type of workloads (e.g., web servers, load balancers, image transcoders, key-value stores etc.). It includes projects that are internal to Google and those belonging to external customers. Each traffic matrix in the dataset contains uniformly sampled VM-to-VM traffic aggregated over a 1-hour window.”, Pang expressly uses zone/location as a grouping criterion and reports clusters corresponding to the same zone. That teaches classification of nodes/VMs by network zone.)
classifying nodes of the network as belonging to one of multiple network data tiers; (Pang, page 1216, col. 1, paragraph 1, “Challenge: Scale. Y can be large, since projects can have tens of thousands of VMs. We have observed, through manual inspection of cloud projects, that to enable projects to scale, designers often group VMs that perform similar functions. At the front-end, load-balancers redirect requests to VMs that scale with the request load; all these VMs perform the same function (e.g., handle requests). In turn, at the back-end, these VMs may invoke other services that may be replicated across several identical VMs, or may send the request to a coordinator VM that invokes an iterative distributed computation spread across several identical VMs. Such structures result in VM groupings.”
Pang, page 219, col. 1, last paragraph, “Moreover, CloudCluster can handle projects with varying functional and geographical diversity. Projects A, B, E and F each run more than 20 different kinds of software and span across a number of zones across the globe. This also explains why they have many clusters (recall that clusters are distinguished both by function and location).”, Pang groups VMs by function, which is a direct BRI read on classifying nodes into different network data tiers.)
and identifying connectivity patterns of each node in the network with respect to multiple predefined time windows. (Pang, page 1215, section 3.1, “Notation. The input to CloudCluster is a VM-to-VM traffic matrix for a cloud project, containing traffic volumes between each VM over a fixed aggregation window.4 Traffic volumes are obtained by sampling flows. In §4, we discuss the actual values of the aggregation window and the sampling frequency.”,
Pang, page 1218, col. 1, paragraph 1, “The dataset includes projects of VMs with various type of workloads (e.g., web servers, load balancers, image transcoders, key-value stores etc.). It includes projects that are internal to Google and those belonging to external customers. Each traffic matrix in the dataset contains uniformly sampled VM-to-VM traffic aggregated over a 1-hour window.”, Pang identifies VM-to-VM traffic relationships over a fixed aggregation window and then tracks changes across successive aggregation windows. That directly teaches identifying node connectivity patterns with respect to multiple predefined time windows.)
The rationale for combining Ferriol and Mari with Pang is similar to that applied for claim 7 above.
Claim 12 is rejected under 35 U.S.C. 103 as being unpatentable over Ferriol in view of Mari and Qi et al, (Qi, Y., Jiang, R., Jia, Y., & Li, A. (2020). Attack analysis framework for cyber-attack and defense test platform. electronics, 9(9), 1413.), hereafter referred to as Qi.
Claim 12: Ferriol and Mari teaches the limitations of claim 1,
Qi, in the same field of network knowledge graph implementation further teaches the following which Ferriol and Mari fail to teach:
The method of claim 1, wherein the invariant properties of the network are represented as knowledge graph, (Qi, page 1, section 1, paragraph 2, “A knowledge graph constructed based on a computer network is called a cyber security knowledge graph (CSKG), and the CSKG includes two parts: a security knowledge graph (SeKG) and a scene knowledge graph (ScKG). The SeKG includes known information about vulnerabilities, attacks, assets and the relationships among them. The above information can be obtained from various vulnerability and attack analysis websites and can be updated gradually. The ScKG includes network node information and network connectivity information involved in specific attacks. Generally, the SeKG is the core graph and the ScKG is the extended graph.”
Qi, page 4, section 3.1.1, “This paper uses the five-tuple model proposed by Jia Yan et al. [24] to construct a security knowledge graph. The five-tuple model includes entities, attributes of entities, relationships between entities, and reasoning rules. We use SeKG (security knowledge graph) to represent the security knowledge graph, SO (security ontology) to represent the security knowledge ontology, SI (security This paper uses the five-tuple model proposed by Jia Yan et al. [24] to construct a security knowledge graph. The five-tuple model includes entities, attributes of entities, relationships between entities, and reasoning rules. We use SeKG (security knowledge graph) to represent the security knowledge graph, SO (security ontology) to represent the security knowledge ontology, SI (security instance) to represent the security instance, SOP (security object properties) to represent the relationships between the security ontologies, SDP (security data properties) to represent the properties of the security instance and SRR (security reasoning rule) to represent the reasoning rules of security knowledge.”, Qi expressly teaches constructing a scene knowledge graph as part of a cyber security knowledge graph for analyzing network/cyber state. That directly teaches representing network-related properties in a knowledge-graph form.)
wherein vertices included in the knowledge graph represent network nodes, zones, network data tiers, or network connectivity in predefined time windows, (Qi, page 4, section 3.1.1.1, paragraph 1, “The five-tuple model includes entities, attributes of entities, relationships between entities, and reasoning rules… SO = {SOi | i = 1,…,n}. Security knowledge ontology is a concept summarized and abstracted from security knowledge … SI = {SIi | i = 1,…,m}. The security instance is the specific security knowledge corresponding to the last level of an ontology …”;
Qi, page 10, paragraph 1, “The scene knowledge graph is composed of the details of multiple simulation attacks of the scene, including node IP, software and hardware, existing vulnerabilities, backdoors, standby status, network status, open services and ports, and so on. The scene knowledge graph is composed of the details of multiple simulation attacks of the scene, including node IP, software and hardware, existing vulnerabilities, backdoors, standby status, network status, open services and ports, and so on. An ontology model is also needed to construct a scene knowledge graph, and the focus of scene knowledge is data attributes. Construct the node ontology, software ontology, hardware ontology, An ontology model is also needed to construct a scene knowledge graph, and the focus of scene knowledge is data attributes. Construct the node ontology, software ontology, hardware ontology, backdoor ontology, standby state ontology, network state ontology, port ontology, service ontology and vulnerability ontology.”
Qi, page 14, paragraph 6, “after the analysis of the input data within a time window is completed, the analysis results are cached and output as intermediate results. With the offset of the time window, the results of each analysis are iteratively output. When the attack ends, the complete attack chain will be output. Intermediate results and final results are output in the form of an attack chain”, The claimed vertices correspond to Qi’s knowledge graph of entities / ontologies / instances. Qi expressly teaches a knowledge graph containing entities and instances, and then, for the scene knowledge graph, teaches specific ontology categories including node ontology (mapping to claimed network nodes), service ontology (mapping to claimed network data tiers), and network state ontology (mapping to claimed network connectivity / state). Qi also expressly performs analysis “within a certain time interval,” which teaches time-windowed graph information. Thus, Qi’s KG entities / ontology nodes are what are being interpreted as the claimed graph vertices.)
and edges between vertices represent relationships between the vertices. (Qi, page 5, paragraph 2, “SOP =< SOi, Rcc, SOj>||. The object property of the security instance is the relationship between the security instances.”,
Qi, page 5, paragraph 2, “the relationship between multi-level ontologies is subClassOf … the relationship between different ontologies includes hasExit and exploit … the relationship between ontology and instance is instanceOf …”, Qi expressly defines graph relationships as tuples connecting ontology nodes / instances to other ontology nodes / instances. Those tuples are the claimed edges between vertices, and the labels subClassOf, hasExit, exploit, and instanceOf are the claimed relationships between the vertices. Thus, Qi directly teaches that the connections between KG nodes represent relationships among those nodes.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have incorporated the teachings of Qi into the combination of Ferriol and Mari. A motivation to do so would have been to represent Ferriol’s inferred network-state / invariant-property information in a knowledge-graph form so that the information could be more effectively organized, related, and analyzed in the verification framework. Qi teaches a framework that “stores prior knowledge in a cyber security knowledge graph” and aims to achieve a balance between “automated analysis and real-time accurate performance,” which would have suggested representing Ferriol’s network entities, states, and relationships as a knowledge graph for more structured cyber/network reasoning. Doing so would have been a predictable design choice because Ferriol already generates graph-based network-state information, and Qi shows the benefit of storing and analyzing such cyber/network knowledge in KG form.
Claim 14 is rejected under 35 U.S.C. 103 as being unpatentable over Ferriol in view of Mari, Pang, Bordes et al., (Bordes, A., Usunier, N., Garcia-Duran, A., Weston, J., & Yakhnenko, O. (2013). Translating embeddings for modeling multi-relational data. Advances in neural information processing systems, 26.), hereafter referred to as Bordes, and Qi.
Claim 14: Ferriol, Mari, and Pang teaches the limitations of claim 11, Bordes, in the same field of network knowledge graph implementation further teaches the following which Ferriol, Mari, and Pang fail to teach:
The method of claim 11, wherein processing the network data to generate data that represents invariant properties of the network further comprises: processing data representing the classified nodes and identified connectivity patterns using a translational distance model to identify relationships between the classified nodes and identified connectivity patterns; (Bordes, page 2, paragraph 3, “In this paper, we introduce TransE, an energy-based model for learning low-dimensional embeddings of entities. In TransE, relationships are represented as translations in the embedding space: if (h, ,t) holds, then the embedding of the tail entity t should be close to the embedding of the head entity h plus some vector that depends on the relationship . Our approach relies on a reduced set of parameters as it learns only one low-dimensional vector for each entity and each relationship.”
Bordes, page 3, paragraph 1, “The basic idea behind our model is that the functional relation induced by the-labeled edges corresponds to a translation of the embeddings, i.e. we want that h+ ≈twhen(h, ,t)holds (t should be a nearest neighbor of h+ ), while h+ should be far away from t otherwise. Following an energy-based framework, the energy of a triplet is equal to d(h + ,t)for some dissimilarity measure d, which we take to be either the L1 or the L2-norm.”, Bordes expressly teaches a translational embedding model in which relationships are represented as translations and the relational condition is h + ℓ ≈ t. That is a direct read on the claimed translational distance model used to identify relationships among entities/patterns. )
It would have been further obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have incorporated the teachings of Bordes into the combination of Ferriol, Mari, and Pang. A motivation to do so would have been to identify and model relationships among Pang’s classified entities using a compact and scalable relational-learning technique. Bordes teaches a model that is “easy to train” and can “scale up to very large databases,” (Bordes, abstract) while modeling relations as translations in embedding space, which would have suggested using TransE-style translational embeddings to discover and represent relationships among the network classes, tiers, zones, and time-window entities derived from Pang and Ferriol. That would have been a predictable way to supply a computationally efficient relationship-identification model within the broader graph / quantum-assisted verification context.
Qi, in the same field of network knowledge graph implementation further teaches the following which Ferriol, Mari, Pang, and Bordes fail to teach:
and generating a knowledge graph using the classified nodes, identified connectivity patterns, and relationships between the classified nodes and identified connectivity patterns, wherein vertices included in the knowledge graph represent network nodes, zones, data tiers, or time windows and edges between vertices represent relationships between the vertices. (Qi, page 10, paragraph 1, “The scene knowledge graph is composed of the details of multiple simulation attacks of the scene, including node IP, software and hardware, existing vulnerabilities, backdoors, standby status, network status, open services and ports, and so on. The scene knowledge graph is composed of the details of multiple simulation attacks of the scene, including node IP, software and hardware, existing vulnerabilities, backdoors, standby status, network status, open services and ports, and so on. An ontology model is also needed to construct a scene knowledge graph, and the focus of scene knowledge is data attributes. Construct the node ontology, software ontology, hardware ontology, An ontology model is also needed to construct a scene knowledge graph, and the focus of scene knowledge is data attributes. Construct the node ontology, software ontology, hardware ontology, backdoor ontology, standby state ontology, network state ontology, port ontology, service ontology and vulnerability ontology.”
Qi, page 14, paragraph 6, “after the analysis of the input data within a time window is completed, the analysis results are cached and output as intermediate results. With the offset of the time window, the results of each analysis are iteratively output. When the attack ends, the complete attack chain will be output. Intermediate results and final results are output in the form of an attack chain”, Qi teaches generating a scene knowledge graph from network/cyber inputs using explicit ontologies such as node ontology and service ontology, and teaches that the object property is the relationship between the security instances.)
It would have been further obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have incorporated the teachings of Qi into the combination of Ferriol, Mari, Pang, and Bordes. A motivation to do so would have been to generate and use a cybersecurity knowledge graph from the classified entities and learned relationships so that the resulting information could be analyzed in a structured cyber/network reasoning framework. Qi teaches both a cyber security knowledge graph and the fusion of “multi-source heterogeneous input data,” (Qi, page 2, paragraph 3) which would have suggested taking the classified network entities from Pang and the learned relationships from Bordes and instantiating them in a CSKG-style representation for cyber/network status analysis. A skilled artisan would have found this combination straightforward because Qi expressly provides the KG-based framework into which the Pang-derived entities and Bordes-derived relationships could be placed for automated attack/status analysis.
Claim 15 is rejected under 35 U.S.C. 103 as being unpatentable over Ferriol in view of Mari, and Javed.
Claim 15: Ferriol, and Mari teaches the limitations of claim 1, Javed, in the same field of network knowledge graph implementation further teaches the following which Ferriol and Mari fail to teach:
The method of claim 1, further comprising: receiving network validation results of the live check of the network; (Javed, page 5, paragraph 4, “The IDS detects intrusions in the CPS and generates alerts that specifies the CPS components that are compromised. The following pseudocode describes the damage assessment process.”
Javed, page 7, last paragraph, “Once the recovery process of the system is complete, the normal communication of all the CPS components is restored. Recovery manager also records the activities of IREC and forwards this information to PEM.”, Javed teaches receiving intrusion/monitoring alerts and then recording the activities of the response/recovery system. Under BRI, those alerts/results are the recited network validation results received after checking the network state.)
inferring a network status using the selected network verification mechanisms; (Javed, page 8, paragraph 3, “We introduce ω as a measure of serviceable CPS functions, and derive δ from ω that reflects the impairment of CPS functions caused by an attack. The metrics are defined as follows… Damage extent (δ): the compromised CPS functionality in terms of percentage of components damaged in an attack for a CPS function.”, Javed infers the system/network status by identifying compromised components and quantifying damage extent and operational availability. That teaches inferring the status of the network from the validation/detection results. )
generating a network verification output that indicates whether problems or failures still exist in the network using the network validation results of the live check and the inferred network status; (Javed, page 8, paragraph 3, “We introduce ω as a measure of serviceable CPS functions, and derive δ from ω that reflects the impairment of CPS functions caused by an attack. The metrics are defined as follows Operational availability (ω): the available CPS functionality in terms of percentage of components unaffected in an attack for a CPS function. Damage extent (δ): the compromised CPS functionality in terms of percentage of components damaged in an attack for a CPS function.”, Javed’s metrics output—operational availability and damage extent—expressly indicates whether the attack/problem remains and how much of the system is still impaired. That is a direct read on a network verification output indicating whether problems or failures still exist.)
and processing the network verification output to determine whether to initiate one or more remedial actions on the network. (Javed, page 7, last paragraph, “Similar to response manager, the recovery manager interfaces with CPS control system. Recovery manager directs recovery instructions to the CPS controllers to take corrective actions based on the information provided by the RPK module, for a particular attack.”, Javed expressly teaches that the recovery manager directs instructions to controllers to take corrective actions based on the analysis/recovery information. That directly teaches processing the verification output to decide whether remedial actions should be initiated.)
The rationale for the combination of Ferriol and Mari with Javed is similar to that as applied for claim 2 above.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HYUNGJUN B YI whose telephone number is (703)756-4799. The examiner can normally be reached M-F 9-5.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Usmaan Saeed can be reached on (571) 272-4046. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/H.B.Y./Examiner, Art Unit 2146
/USMAAN SAEED/Supervisory Patent Examiner, Art Unit 2146
Prosecution Insights