DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
Applicant’s amendment, filed 08/19/2026, has been entered and fully considered.
In light of Applicant’s amendment, the rejection of claims 1-19 under 35 U.S.C. 112(a) has been withdrawn.
In light of Applicant’s amendment, the rejection of claims 4, 14 under 35 U.S.C. 112(b) has been withdrawn.
In light of Applicant’s amendment, the rejection of claims 1-19 under 35 U.S.C. 101 has been withdrawn.
Response to Arguments
Applicant’s arguments with respect to the rejection of claim(s) 1-19 under 35 U.S.C. 103, see pages 12-18, have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Interpretation
The Examiner notes:
The broadest reasonable interpretation of a method (or process) claim having contingent limitations requires only those steps that must be performed and does not include steps that are not required to be performed because the condition(s) precedent are not met. See MPEP 2111.04(II).
With respect to claim 6, it recites the following conditions and corresponding contingent steps:
With respect to claim 6, since the claim does not require the condition of “detecting a malware object on the cloud entity” or “determining an exposure path to the cloud entity”, etc., the contingent step “generating the alert” need not be carried out in order for the claimed method to be performed.
Claim Objections
Claims 1, 7, 10-11, 17 are objected to because of the following informalities:
Claims 1, 10-11 recite “…based on the severity index; wherein…” This appears to be grammatically incorrect. The Examiner recommends reciting a comma instead of a semicolon. For example, “…based on the severity index[[;]], wherein…”.
Claims 7, 17 recite “…representing the cloud entity; and wherein the…”. This appears to be grammatically incorrect. The Examiner recommends reciting a comma instead of a semicolon. The Examiner recommends reciting “…representing the cloud entity[[;]], and wherein the…”.
Appropriate correction is required.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 1-19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Grubel et al. (USP App Pub 2014/0157417; hereinafter Grubel) in view of Attar et al. (USP App Pub 2021/0288995; hereinafter Attar).
Regarding claim 1, A method performed by a computing system for prioritizing alerts and mitigation actions (Grubel: paragraph [0056], “The user may run these rules to generate a report with recommendations”; paragraph [0002], “the network or system may also be changed to remove or limit the identified vulnerabilities”) against cyber threats (Grubel: paragraph [0056], “the system itself performs threat analysis as the network architecture is being created or after it has been created”) in a cloud computing environment implemented on at least one cloud computing infrastructure (Grubel: paragraph [0028], “methods and systems for performing efficient architecture-centric threat analysis on networked systems are disclosed”), comprising:
receiving an alert (Grubel: paragraph [0056], “The results of the threat analysis are referred to as findings”) based on a cloud entity deployed in the cloud computing environment (Grubel: paragraph [0056], “the system itself performs threat analysis as the network architecture is being created or after it has been created”), wherein the alert includes an identifier of the cloud entity (Grubel: paragraph [0056], “The various findings for a particular network object may be associated with the network object and stored to database 206 as an attribute of the associated network object”) and a severity indicator (Grubel: paragraph [0053], “processor 104 is configured to associate the stored plurality of attributes of the objects with the selected network objects in the network architecture… attribute data includes … known threats/weaknesses of the object”), and wherein the cloud computing environment is represented by a security graph (Grubel: FIG. 15, 1500 is a data flow on the network; paragraph [0060], “The data flow analysis for each of these flows 1500, 1502, and 1504 indicates several vulnerabilities (or findings) 1506 for particular network objects (or nodes)”; paragraph [0062], “the combined network 1600 may be analyzed as a whole in addition to analysis of individual slices 1500, 1502, and 1504”), wherein the security graph is stored in a memory of the computing system (Grubel: paragraph [0033], “a storage device may store (e.g., have embodied thereon) … data flows”) and includes a plurality of nodes (Grubel: paragraph [0051], “Network objects are specific nodes within a data flow”; paragraph [0029], “The exemplary methods and systems permit tracking of vulnerabilities when applied to multiple objects across multiple data flows concurrently for better tracking/resolution”), at least one of the nodes being a resource node representing a resource of the cloud computing environment (Grubel: paragraph [0051], “Network objects are specific nodes within a data flow. The objects include physical components, processes, external interactors, data stores”), at least one of the nodes being a principal node representing a principal of the cloud computing environment (Grubel: FIG. 17, attacker is a node in the network and is connected via a directed edge to node 1720; paragraph [0062], “the combined network 1600 may be analyzed as a whole in addition to analysis of individual slices 1500, 1502, and 1504. For example, in FIG. 17, network 1600 is analyzed to show potential routes that an attacker may take to reach, for example, node 1512”; Instant application specification: paragraph [0028], “A resource may also be a principal, when operating on another resource”) and when a particular cybersecurity threat is detected in at least two of the plurality of nodes (Grubel: paragraph [0060], “several vulnerabilities (or findings) 1506 for particular network objects (or nodes) 1508-1516”; FIG. 15, node 1508 and node 1510 have a finding of a vulnerability), at least one of the nodes being a vulnerability node for the particular cybersecurity threat (Grubel: paragraph [0060], “several vulnerabilities (or findings) 1506”; FIG. 15, upper node 1506 is a vulnerability node) that is connected by a respective edge to each of the at least two nodes of the security graph (Grubel: FIG. 15, upper node 1506 is connected by respective directed edges to each of node 1508 and node 1510) in which the particular cybersecurity threat is detected (Grubel: paragraph [0060], “several vulnerabilities (or findings) 1506 for particular network objects (or nodes) 1508-1516”; FIG. 15, node 1508 and node 1510 have a finding of a vulnerability);
…
wherein the computing system is implemented in the cloud computing environment (Grubel: paragraph [0039], “program code stored in a computer-readable storage medium in a server computing device may be downloaded over a network from the server to computing device 100”).
Grubel does not teach …generating a severity index for the received alert based on the identifier of the cloud entity, a query of the security graph, and the severity indicator; and initiating a mitigation action based on the severity index; …
However, in the same field of endeavor, Attar does teach …generating a severity index for the received alert (Attar: paragraph [0098], “operation 102, a security risk scores computation procedure is conducted in order to evaluate and prioritize the security gaps which may have been detected in the network”; FIG. 1, Risk Score Computation 102 takes as input 1) device important scores 0.c, 2) network attack graph 0.a with cycles removed, and 3) vulnerability scores 0.b) based on the identifier of the cloud entity (Attar: paragraph [0077], “device importance scores are calculated to show the availability of non-negative indicators of assets' importance or business impact, for every device on the network”), a query of the security graph (Attar: paragraph [0078], “operation 100 may include the removal of cycles from the attack graph”), and the severity indicator (Attar: paragraph [0076], “a vulnerability score is calculated to show the availability of non-negative indicators of a security risk”); and
initiating a mitigation action based on the severity index (Attar: claim 12, “wherein the risk score evaluation is followed by protective measures to be conducted upon the network”; claim 13, “wherein the protective measures comprise patching the network”); …
it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the threat analysis data flow network graph of Grubel to incorporate the teachings of Attar to generate a risk score based on the graph and execute a protective action. The motivation for doing so is to prioritize fixing the most critical vulnerabilities (Attar: paragraph [0005], “By using an industrial-dedicated automation tools, one can significantly reduce the time and efforts that go into identifying, sorting, prioritizing, and resolving emerging security threats. In order to achieve effective and efficient automation, there is a need to collect and prioritize relevant data which in turn may help security teams to focus their resources fixing the most critical vulnerabilities first”).
Regarding claim 2, Grubel and Attar teach the method of claim 1, further comprising:
generating the mitigation action (Attar: claim 12, “wherein the risk score evaluation is followed by protective measures to be conducted upon the network”) based on the received alert (Attar: paragraph [0098], “a security risk scores computation procedure is conducted in order to evaluate and prioritize the security gaps which may have been detected in the network”).
The motivation for combining references in claim 2 is the same as the motivation stated in the rejection of claim 1.
Regarding claim 3, Grubel and Attar teach the method of claim 1, further comprising:
generating the severity index (Attar: paragraph [0099], “the computation of the security risk scores 102 accounts for 3 following factors:…”) based on a policy of the cloud computing environment (Attar: paragraph [0102], “The potential distribution of attacks (e.g. the topology of the graph), for example, exploits into devices and network segments with a low number of incoming exploits and a high number of outgoing exploits will have higher importance and vice versa, and will affect the security risk scores 102 accordingly”).
The motivation for combining references in claim 3 is the same as the motivation stated in the rejection of claim 1.
Regarding claim 4, Grubel and Attar teach the method of claim 3, wherein
the policy includes a plurality of attributes (Attar: paragraph [0102], “The potential distribution of attacks (e.g. the topology of the graph)…”), each of the plurality of attributes corresponding to an attribute of a node representing the cloud entity in the security graph (Attar: paragraph [0102], “exploits into devices and network segments with a low number of incoming exploits and a high number of outgoing exploits will have higher importance and vice versa, and will affect the security risk scores 102 accordingly”).
The motivation for combining references for claim 4 is the same as the motivation for combining references stated in the rejection of claim 1.
Regarding claim 5, Grubel and Attar teach the method of claim 4, wherein
at least a portion of the plurality of attributes (Attar: paragraph [0102], “exploits into devices and network segments with a low number of incoming exploits and a high number of outgoing exploits will have higher importance and vice versa, and will affect the security risk scores 102 accordingly”) each corresponds to a vulnerability indicator (Attar: paragraph [0102], “The potential distribution of attacks (e.g. the topology of the graph)…” i.e., it indicates the vulnerability of a potential attack).
The motivation for combining references for claim 5 is the same as the motivation for combining references stated in the rejection of claim 1.
Regarding claim 6, Grubel and Attar teach the method of claim 1, further comprising:
generating the alert (Grubel: paragraph [0056], “The results of the threat analysis are referred to as findings”; Attar: paragraph [0098], “a security risk scores computation procedure is conducted in order to evaluate and prioritize the security gaps which may have been detected in the network”) in response to any one of: detecting a malware object on the cloud entity (Attar: paragraph [0132], “Signature-based threats detection is often used to identify known IT threats. In IT, most objects have attributes that can be used to create a unique signature…. When an object is identified as malicious, its signature is added to a database of known malware” i.e., presence of a known IT threat is a security gap that is detected), determining an exposure path to the cloud entity , detecting a lateral movement associated with the cloud entity, detecting a misconfiguration, and detecting a policy violation in a corresponding infrastructure as code environment.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the threat analysis of Grubel to incorporate the teachings of Attar to use malware detection to identify security gaps. The motivation for doing so is to quickly identify malware to block it (Attar: paragraph [0132], “among the protective measures that may be activated are blocking of malicious application signatures …quickly and efficiently scan an object to determine its digital signature”).
Regarding claim 7, Grubel and Attar teach the method of claim 1, wherein the query of the security graph (Attar: paragraph [0078], “operation 100 may include the removal of cycles from the attack graph”; paragraph [0130], “Cycles may be removed using FindCyclicEdges algorithm as disclosed above”) is:
based on the identifier of the cloud entity (Attar: paragraph [0080], “START denotes the attacker's initial location on the graph (as per FIG. 2)”) to generate an identifier of another node (Attar: paragraph [0097], “wherein cycle c=v1, . . . , vn, v1 ” i.e., vn is another vertex and therefore another node), wherein the another node is connected by an edge to a node representing the cloud entity (Attar: paragraph [0128], “(h, e) is a cyclic edge because all the paths (for example, path 26) from a to h pass through e”; FIG. 2B, node e is identified and is connected by an edge to start node a); and
wherein the severity index is generated (Attar: paragraph [0078], “operation 100 may include the removal of cycles from the attack graph”) further based on the identifier of the another node (Attar: paragraph [0128], “FIG. 2C represents a modified representation of said attack graph after the removal of cyclic edges disclosed above”; FIG. 2C, edge (h, e) is removed).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the graph of Grubel to incorporate the teachings of Attar to remove cycles in the graph. The motivation for doing so is to not mislead generating the risk score (Attar: paragraph [0129], “A cycle can mislead the computation of security metrics … Therefore, it may be beneficial to remove such cycles from the attack graph”).
Regarding claim 8, Grubel and Attar teach the method of claim 1, wherein
the severity indicator (Grubel: paragraph [0053], “processor 104 is configured to associate the stored plurality of attributes of the objects with the selected network objects in the network architecture… attribute data includes … known threats/weaknesses of the object”) is received from a common vulnerabilities and exposures database (Attar: paragraph [0076], “a vulnerability score is calculated to show the availability of non-negative indicators of a security risk … According to some embodiments, Common Vulnerability Scoring System (CVSS) may often be used for this purpose”).
The motivation for combining references for claim 8 is the same as the motivation for combining references stated in the rejection of claim 1.
Regarding claim 9, Grubel and Attar teach the method of claim 1, further comprising:
inspecting the cloud entity to detect a cybersecurity threat (Attar: paragraph [0129], “a vulnerability score is determined for each one of said detected vulnerabilities by conducting comprehensive vulnerability analysis”); and
generating the severity indicator based on the detected cybersecurity threat (Attar: paragraph [0076], “a vulnerability score is calculated to show the availability of non-negative indicators of a security risk”).
The motivation for combining references for claim 9 is the same as the motivation for combining references stated in the rejection of claim 1.
Re. claims 10-11, they recite analogous limitations as claim 1 and therefore are rejected for the same reasons.
Re. claims 12-19, they recite analogous limitations as claims 2-9, respectively, and therefore are rejected for the same reasons.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ADITYA SRIRAM whose telephone number is (703)756-1715. The examiner can normally be reached M-Sa: 9:00 AM - 5:00 PM MST or PST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, William Korzuch can be reached at (571) 272-7589. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/A.S./ Examiner, Art Unit 2491
/WILLIAM R KORZUCH/ Supervisory Patent Examiner, Art Unit 2491
Prosecution Insights