CTNF 18/181,354 CTNF 78580 DETAILED ACTION Notice of Pre-AIA or AIA Status 07-03-aia AIA 15-10-aia The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. This office action is in response to claims filed 3/9/2023. Claims 1-20 have been examined. This office action is Non-Final. Examiner Notes Claims 15-20 recite a “one or more computer readable storage media”. The Applicant’s specification states, “a computer readable storage medium is not to be construed as storage in the form of one or more transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide, light pulses passing through a fiber optic cable, electrical signals communicated through a wire, and/or other transmission media” (para. 0065 of Applicant’s specification). Claim Rejections - 35 USC § 103 07-06 AIA 15-10-15 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. 07-20-aia AIA The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 07-21-aia AIA Claim s 1-2, 6-9, 13-16, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Costante (2023/0370479) in view of Trost (10,902,114) . As per claim 1, Costante discloses a method for cyber intrusion attribution, the method comprising: initiating incident data tracking and actor intelligence data tracking in response to an intrusion (Costante: para. 0030, monitoring (i.e. tracking) events over which a threat actor may perform cyber threat intelligence) ; generating an intrusion comparison data set for each of a plurality of categories for both the incident data and the actor intelligence data (Costante: para. 0018-0019, categories (i.e. indicators of compromise) ; identifying a potential actor attribution based on comparing each of the intrusion comparison data sets for the incident data with the corresponding intrusion comparison data set for the actor intelligence data (Costante: para. 0023, 0049, identifying a threat actor) . Costante does not disclose comparing each intrusion comparison data set for the incident data with a corresponding intrusion comparison data set for the actor intelligence data. However, analogous art of Trost discloses comparing each intrusion comparison data set for the incident data with a corresponding intrusion comparison data set for the actor intelligence data (Trost: col. 5, lines 26-35, col. 6, lines 38-42, comparing incident and actor) . It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include comparing each intrusion comparison data set for the incident data with a corresponding intrusion comparison data set for the actor intelligence data of Trost with the system/method of Costante, the motivation is the automated integration of cybersecurity threat indicators, efficiently harness actionable intelligence in the response to cyber threats and actors (Trost: col. 2, lines 43-47). As per claim 2, Costante and Trost disclose the method of claim 1, wherein initiating incident data tracking and actor intelligence data tracking further comprises: processing the incident data and the actor intelligence data; and augmenting the incident data and the actor intelligence data with extended indicators of compromise (Costante: para. 0018-0019, 0030, indicators of compromise (IoC)) . As per claim 6, Costante and Trost disclose the method of claim 1, Costante further discloses wherein the incident data tracking and the actor intelligence data tracking is conducted in two independent cycles being performed in parallel to one another (Costante: para. 0030, monitor occurrence of the attack pattern (i.e. incident)) . As per claim 7, Costante and Trost disclose the method of claim 1, Costante further discloses creating an incident aggregate category intrusion comparison data set across the plurality of categories; and creating an actor intelligence aggregate category intrusion comparison data set across the plurality of categories (Costante: para. 0018-0019, categories (i.e. indicator of compromise)) . As per claim 8, rejected under similar basis as claim 1 above. As per claim 9, rejected under similar basis as claim 2 above. As per claims 13-14, rejected under similar basis as claims 6-7 above. As per claim 15, rejected under similar basis as claim 1 above. As per claim 16, rejected under similar basis as claim 2 above. As per claim 20, rejected under similar basis as claim 6 above . 07-21-aia AIA Claim s 3, 10, and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Costante (2023/0370479) in view of Trost (10,902,114), and further in view of Vidas (2019/0141079) . As per claim 3, Costante and Trost disclose the method of claim 2. Costante and Trost do not explicitly disclose wherein processing the incident data and the actor intelligence data comprises normalizing the incident data and the actor intelligence data using one or more normalization techniques. However, analogous art of Vidas discloses processing the incident data and the actor intelligence data comprises normalizing the incident data and the actor intelligence data using one or more normalization techniques (Vidas: para. 0007, 0038, and 0048, normalizing the security data) . It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include processing the incident data and the actor intelligence data comprises normalizing the incident data and the actor intelligence data using one or more normalization techniques of Vidas with the system/method of Costante and Trost, the motivation is that one can accurately track the root causes of incidents (Vidas: para. 0007). As per claim 10, rejected under similar basis as claim 3 above. As per claim 17, rejected under similar basis as claim 3 above . 07-21-aia AIA Claim s 4, 11, and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Costante (2023/0370479) in view of Trost (10,902,114), and further in view of Ji (2023/0082289) . As per claim 4, Costante and Trost disclose the method of claim 1, Costante and Trost do not disclose; however, Ji discloses wherein comparing each intrusion comparison data set further comprises: generating a fuzzy hash for each of the intrusion comparison data sets; and applying one or more similarity algorithms in matching the corresponding intrusion comparison data set based on the fuzzy hashes (Ji: para. 0059, 0065, fuzzy hash) . It would have been obvious to one of ordinary skill before the effective filing date of the claimed invention to include comparing each intrusion comparison data set further comprises: generating a fuzzy hash for each of the intrusion comparison data sets; and applying one or more similarity algorithms in matching the corresponding intrusion comparison data set based on the fuzzy hashes of Ji with the system/method of Costante and Trost, the motivation is that can be very useful in identifying/mitigating the potential harm such new malware can pose (Ji: para. 0059) . As per claims 11 and 18, rejected under similar basis as claim 4 above . 07-21-aia AIA Claim s 5, 12, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Costante (2023/0370479) in view of Trost (10,902,114), and further in view of Amsler (2014/0201836) . As per claim 5, Costante and Trost disclose the method of claim 1, Costante and Trost do not disclose; however, Amsler discloses wherein the incident data tracking is initiated in an Incident Tracking Platform and the actor intelligence data tracking is initiated in an Actor Intelligence Tracking Platform (portal/platform #22, portal/platform #48) . It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the incident data tracking is initiated in an Incident Tracking Platform and the actor intelligence data tracking is initiated in an Actor Intelligence Tracking Platform of Amsler with the system/method of Costante and Trost, the motivation allows managers to view analyst performance metrics as well as customize their threat intelligence feeds (Amsler: para. 0079). As per claims 12 and 19, rejected under similar basis as claim 5 above. The following prior art cited to further show the state of the art at the time of the Applicant’s invention. Seck (2023/0259419) Incident Resolution System Conclusion Any inquiry concerning this communication or earlier communications from the examiner should be directed to JENISE E JACKSON whose telephone number is (571)272-3791. The examiner can normally be reached M-F 7:00am-3:30pm. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Philip J Chea can be reached at (571) 272-3951. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 5/28/2026 /J.E.J/Examiner, Art Unit 2499 /PHILIP J CHEA/Supervisory Patent Examiner, Art Unit 2499 Application/Control Number: 18/181,354 Page 2 Art Unit: 2499
Prosecution Insights