Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments filed 5/29/26 have been fully considered but they are not persuasive.
First examiner notes that the arguments filed 5/29/26 are almost verbatim, repeated from 11/10/25. As such they have already been addressed in the final office action submitted on 3/3/26. Examiner will not address these arguments a second time. If Applicant wishes to see a reply to these arguments, Examiner points to the previous office action.
Applicant has made no moves to advance prosecution otherwise, as the claims have not been amended. Examiner has thusly been forced to repeat the prior rejection.
In addition, Applicant has argued that Vajipayajula teaches “graph database represents entities” but that this is “not teaching a representation of the cloud computing environment”. Unfortunately, Examiner disagrees. The term “representation of cloud computing environment” is broad enough that a node/representation of a server/client/device in a cloud computing environment meets the claim language as stated. Examiner also asserts that a graph of security data in the context of cloud computing infrastructure, would also be “representative of a cloud computing environment”
Applicant is purely arguing the definition of “graph includes a representation of a cloud entity”. Examiner again states that this claim language is broad and that Vajipayajula reasonably anticipates it, as does the Salman reference. Examiner asserts that both Vajipayajula and Salman may anticipate claim 1. That the references have overlapping teachings does not disqualify either reference.
Examiner notes NEW Claim 22 states “detect additional data records”. The claim gives no context or meaning to “additional data records”. Therefore generating a “compact forensic event log including only the detected data record and additional data records” is interpreted as including in the event log, any record found to be pertinent.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Vajipayajula US 2019/0394225 in view of Giorgio US 11,057,414
As per claims 1, 10, 11. Vajipayajula teaches A method for generating a compact forensic event log based on a cloud log, comprising: traversing a security graph to detect a node representing a cloud entity in a cloud computing environment, deployed on a cloud computing infrastructure wherein the security graph includes a representation of the cloud computing environment; detecting a node representing a cybersecurity threat connected to the node representing the cloud entity; [0023][0040][0063][0068] (teaches creating a knowledge graph based on cloud entities, traversing the graph to detect a cybersecurity threat)
Giorgio teaches parsing a cloud log of the cloud computing environment to detect a data record, the data record including an attribute of the node representing the cloud entity; and generating a compact forensic event log including the detected data record. (Column 5 lines 38-50) (Column 6 lines 5-41)(Column 7 lines 4-48)(Column 9 line 32 to Column 10 line 28) (teaches parsing logs, and attributes of nodes and compressing logs including detected data records)
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to use the logs of Giorgio with the prior art because it provides more comprehensive and yet efficient data records.
As per claims 2, 12 Vajipayajula teaches the method of claim 1, further comprising: receiving an identifier of the cloud entity; and traversing the security graph further based on the received identifier to detect the node representing the cloud entity. [0023][0040][0063][0068] (teaches creating a knowledge graph based on cloud entities, including identifiers and attributes, and traversing it to detect a threat)
As per claims 3, 13. Vajipayajula teaches the method of claim 1, further comprising: detecting the data record further based on an identifier of the cybersecurity threat. [0023][0040][0063][0068] (teaches creating a knowledge graph and traversing it to detect a threat) (Vulnerability information and scores)
As per claims 4, 14 Giorgio teaches the method of claim 1, further comprising: generating the compact forensic event log in response to detecting that the node representing the cloud entity is connected to the node representing the cybersecurity threat. (Column 5 lines 38-50) (Column 6 lines 5-41)(Column 7 lines 4-48)(Column 9 line 32 to Column 10 line 28) (teaches parsing logs, and attributes of nodes, compressing logs, storing logs, threat detection, time periods, data records)
As per claims 5, 15 Giorgio teaches the method of claim 1, wherein the cloud log is any one of: a network log, and a role log. (Column 6 lines 5-10) (network log)
As per claims 6, 16 Vajipayajula teaches the method of claim 1, wherein the attribute is any one of: a unique identifier, an IP address, a workload type, a user account name, a role, and an authentication status. [0023][0040][0063][0068] (teaches creating a knowledge graph and traversing it to detect a threat and identify attributes) (IP address)
As per claims 7, 17 Vajipayajula teaches the method of claim 1, wherein the cybersecurity threat is any one of: a vulnerability, a misconfiguration, and an exploit. [0023][0040][0063][0068] (teaches creating a knowledge graph and traversing it to detect a threat) (Vulnerability information and scores)
As per claims 8, 18 Giorgio teaches the method of claim 1, further comprising: generating the compact forensic event log based on a plurality of cloud logs, each cloud log parsed to detect a data record including the attribute of the node representing the cloud entity. (Column 5 lines 38-50) (Column 6 lines 5-41)(Column 7 lines 4-48)(Column 9 line 32 to Column 10 line 28) (teaches parsing logs, and attributes of nodes, compressing logs, storing logs, threat detection, time periods, data records)
As per claims 9, 19 Giorgio teaches the method of claim 1, further comprising: storing the compact forensic event log in a storage; and storing a time-based portion of the cloud log in the storage. (Column 5 lines 38-50) (Column 6 lines 5-41)(Column 7 lines 4-48)(Column 9 line 32 to Column 10 line 28) (teaches parsing logs, and attributes of nodes, compressing logs, storing logs, threat detection, time periods, data records)
Claim(s) 20, 21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Vajipayajula US 2019/0394225 in view of Giorgio US 11,057,414 in view of Salman US 2023/0088034.
As per claim 20, Salman teaches the method of claim 1 wherein the security graph represents they could computing environment according to a predefined schema. [0032][0046][0047] (teaches security graph representing according to graph construction overlay parameters) [0024][0025][0031] (represents cloud computing).
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to use the teachings of Salman with the prior art of record because it increases security awareness of kill chains.
As per claims 21. Salman teaches the method of claim 1 wherein detecting a node representing a cybersecurity threat connected to the node representing the cloud entity is based on the security graph. [0024][0025][0027][0031][0067][0071][0072] (teaches constructing a security graph with nodes where at least one node represents a cloud entity and detecting a threat from another node)
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to use the teachings of Salman with the prior art of record because it increases security awareness of kill chains.
As per claim 22 Giorgio teaches parsing the cloud log to detect additional data records corresponding to vulnerable resources and generating the compact forensic event log including only the detected data record and the additional data records. (Column 5 lines 38-50) (Column 6 lines 5-41) (teaches metadata collector collecting data records regarding particular nodes, including security log types of malicious action against the same connection node and compressing them/aggregating into one node metadata regarding the events related to the particular node)
Salman teaches the metadata is about a vulnerable resource [0026] (security attributes of entity including vulnerabilities)
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to use the teachings of Salman with the prior art of record because it increases security awareness of kill chains.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CHRISTOPHER BROWN whose telephone number is (571)272-3833. The examiner can normally be reached M-F 8-5.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Luu Pham can be reached on (571) 270-5002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/CHRISTOPHER J BROWN/Primary Examiner, Art Unit 2439
Prosecution Insights