DETAILED ACTION
Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Remarks
2. This Office action is responsive to the Request for Continued Examination (RCE) filed under 37 CFR §1.53(d) for the instant application on September 11, 2026. Applicants have properly set forth the RCE, which has been entered into the application, and an examination on the merits follows herewith.
Claims 1-20 have been examined and rejected. This Office action is responsive to the amendment filed on September 11, 2026, which has been entered in the above identified application.
Claim Rejections - 35 USC § 103
3. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
4. Claims 1-7, 9-17, and 19-20 are rejected under 35 U.S.C. 103 as being unpatentable over Gendelman (U.S. Patent No. 10,108,168), in view of Kroyzer et al (Pub. No. US 2016/0330225), and further in view of Arov et al (U.S. Patent No. 11,093,606).
4-1. Regarding claims 1 and 13, Gendelman teaches the claim comprising: a plurality of non-intrusive sensors configured to monitor activities associated with one or more devices, by disclosing hardware data collectors as part of an abnormal activity monitoring system for an industrial control system (ICS) that monitors the control system programmable logic controllers (PLCs) [column 8, lines 49-61; column 9, lines 21-24; column 9, line 65 to column 10, line 2].
Gendelman teaches wherein at least one non-intrusive sensor of the plurality of non-intrusive sensors is positioned within a physical vicinity of the one or more devices and communicatively isolated from a control system configured to control an operation of the one or more devices, by disclosing that a data collector is configured using an adapter to be connected as a peripheral component of a PLC [column 9, lines 42-46; figure 1B]. The monitoring system may be fully isolated from the protected ICS network and hardware, preventing any potential attack from affecting the monitoring and alerting abilities of the monitoring system [column 16, lines 12-24].
Although Gendelman discloses transmitting the monitored data from the data collectors to a monitoring server [Gendelman, column 9, lines 56-60], Gendelman does not expressly teach an access point device communicatively coupled to the plurality of non-intrusive sensors, wherein the access point device is configured to receive data associated with the monitored activities from the plurality of non-intrusive sensors and further to transmit the data associated with the monitored activities to a computing device for processing. Kroyzer discloses collecting data from sensors [paragraph 37], and transmitting the data to a remote data processing system 118 [paragraph 39; figure 2] before being transmitted to an anomaly detection system 100 for analysis [paragraph 42, lines 1-6]. Use of the remote data processing system 118 would help prevent server overload when a large amount of data is received. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to, before transmitting the monitored data to the monitoring server of Gendelman for analysis, transmit the monitored data to a remote data processing system, as taught by Kroyzer. This would help prevent server overload when a large amount of data is received.
Gendelman-Kroyzer teach the computing device configured to receive the data associated with the monitored activities and process the data to determine an anomaly associated with the one or more devices, by disclosing that an anomaly detection module 104 on the monitoring server analyzes the collected data to detect any anomalies [Gendelman, column 8, line 66 to column 9, line 8; column 10, lines 3-23].
Although Gendelman-Kroyzer disclose detecting abnormal operation by one or more criteria, such as a threshold value being exceeded [Gendelman, column 12, lines 56-63], Gendelman-Kroyzer do not expressly teach wherein the computing device determines the anomaly in response to a difference between the data associated with the monitored activities from the plurality of nonintrusive sensors and data from one or more components in a supervisory control and data acquisition system (SCADA) exceeding a threshold. Arov discloses protecting an industrial system where controllers that interface with a Supervisory Control and Data Acquisition (SCADA) can be attacked to cause the controllers to output data that seemingly reflects normal operation, while the actual operation of the industrial process has been tampered [column 6, lines 12-19]. This is done by adding external sensors to one or more of the subsystems that are unconnected to the SCADA-connected controller and that measure physical parameters [column 3, lines 42-45; column 7, lines 26-35]. At least one dedicated industrial computerized device monitors data outputted from each of the external sensors [column 3, lines 46-48] and from the controllers communicatively coupled to the SCADA [column 8, lines 14-21]. A mismatch is detected between data outputted from each of the external sensors and the monitored output data which is output from the controller [column 3, lines 49-51; column 8, lines 22-36]. The mismatch is linked to one or more attack vectors [column 8, lines 37-40] which identifies a threat, for example, when the data exceeds a defined threshold [column 7, line 47 to column 8, line 10]. This would improve the detection of cyber-attacks. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to determine abnormal operation based on a mismatch between data from external sensors and data from a SCADA, as taught by Arov. This would improve the detection of cyber-attacks. As mentioned above, an abnormal operation is detected by one or more criteria, such as a threshold value being exceeded [Gendelman, column 12, lines 56-63],
As per claim 13, Gendelman-Kroyzer-Arov teach wherein the at least one non-intrusive sensor that monitors activities is different from one or more components in a supervisory control and data acquisition system (SCADA), by disclosing that the data collectors are different from components of a SCADA system [Gendelman, column 9, lines 25-31; figure 1B; Arov, column 3, lines 42-45; column 7, lines 26-35].
4-2. Regarding claim 2, Gendelman-Kroyzer-Arov teach all the limitations of claim 1, wherein the plurality of non-intrusive sensors that capture data associated with the monitored activities is different from the one or more components in the SCADA, by disclosing that the data collectors are different from components of a SCADA system [Gendelman, column 9, lines 25-31; figure 1B; Arov, column 3, lines 42-45; column 7, lines 26-35].
4-3. Regarding claims 3 and 14, Gendelman-Kroyzer-Arov teach all the limitations of claims 1 and 13 respectively, wherein the computing device further determines that the SCADA has been compromised in response to the difference between the data associated with the monitored activities from the plurality of non-intrusive sensors and data from the SCADA exceeding the threshold, by disclosing detecting a mismatch between data outputted from each of the external sensors and the monitored output data which is output from the controller [Arov, column 3, lines 49-51; column 8, lines 22-36]. The mismatch is linked to one or more attack vectors [Arov, column 8, lines 37-40] which identifies a threat, for example, when the data exceeds a defined threshold [Arov, column 7, line 47 to column 8, line 10]. Abnormal operation is detected by one or more criteria, such as a threshold value being exceeded [Gendelman, column 12, lines 56-63].
4-4. Regarding claims 4 and 15, Gendelman-Kroyzer-Arov teach all the limitations of claims 1 and 13 respectively, wherein a sensor of the plurality of non-intrusive sensors is configured to sense one or more of position, presence, proximity, motion, velocity, displacement, temperature, humidity, moisture, acoustic, sound vibration, chemical sensing, gas sensing, liquid flow, force sensing, load sensing, torque sensing, strain sensing, pressure sensing, leaks, threshold levels, electric charges/fields, magnetic fields, acceleration, tilt, radiation, and optical sensing, by disclosing that the data collectors collect all hardware signals, such as electric voltages and currents [Gendelman, column 9, line 65 to column 10, line 2].
4-5. Regarding claims 5 and 16, Gendelman-Kroyzer-Arov teach all the limitations of claims 1 and 13 respectively, wherein the computing device is configured to compare a machine learning model associated with the one or more devices to the data associated with the monitored activities from the plurality of non-intrusive sensors to determine the anomaly based on deviation therefrom, by disclosing determining normal data patterns of operation of the PLC being monitored using machine learning techniques [Gendelman, column 8, lines 61-66] and comparing the collected data to the normal data patterns to detect an anomaly [Gendelman, column 8, line 66 to column 9, line 8].
4-6. Regarding claim 6, Gendelman-Kroyzer-Arov teach all the limitations of claim 1, further comprising a supervisory control and data acquisition system (SCADA) configured to provide data separately from the data associated with the monitored activities from the plurality of non-intrusive sensors, by disclosing monitoring data from the controllers communicatively coupled to the SCADA [Arov, column 8, lines 14-21].
4-7. Regarding claims 7 and 17, Gendelman-Kroyzer-Arov teach all the limitations of claims 1 and 13 respectively, wherein the computing device is configured to identify one or more patterns associated with the one or more devices, and wherein the computing device determines the anomaly in response to the data associated with the monitored activities from the plurality of non-intrusive sensors exceeding a certain threshold when compared to the one or more patterns, by disclosing determining normal data patterns of operation of the PLC being monitored by a learning module of the monitoring server [Gendelman, column 8, lines 61-66] and comparing the collected data to the normal data patterns to detect an anomaly [Gendelman, column 8, line 66 to column 9, line 8]. Abnormal operation is detected by one or more criteria, such as a threshold value being exceeded [Gendelman, column 12, lines 56-63].
4-8. Regarding claims 9 and 19, Gendelman-Kroyzer-Arov teach all the limitations of claims 1 and 13 respectively, wherein the plurality of non-intrusive sensors is configured to monitor the one or more devices and wherein the one or more devices are controlled by a device other than the plurality of non-intrusive sensors, by disclosing that the data collectors are part of an abnormal activity monitoring system for an industrial control system (ICS) that monitors the control system PLCs [Gendelman, column 8, lines 49-61; column 9, lines 21-24; column 9, line 65 to column 10, line 2; Arov, column 3, lines 42-45; column 7, lines 26-35]. The PLCs may be controlled separate from the data collectors [Gendelman, column 1, lines 47-60].
4-9. Regarding claim 10, Gendelman-Kroyzer-Arov teach all the limitations of claim 1, wherein the anomaly is physical intrusion to a facility housing the one or more devices, by disclosing that the system may detect physical interference by an unauthorized person based on sensor and/or command data joint instances [Kroyzer, paragraph 104]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to configure the system of Gendelman to detect physical interference by an unauthorized person, as taught by Kroyzer. This would help increase security to such systems.
4-10. Regarding claim 11, Gendelman-Kroyzer-Arov teach all the limitations of claim 1, wherein the anomaly is a cyberattack, by disclosing detecting cyber-attacks [Gendelman, column 6, lines 21-24; column 10, lines 3-15; Arov, column 6, lines 12-19].
4-11. Regarding claim 12, Gendelman-Kroyzer-Arov teach all the limitations of claim 1, wherein the anomaly is a malfunction associated with the one or more devices, by disclosing detecting any abnormal operation [Gendelman, column 6, lines 21-24; column 10, lines 44-51; Arov, column 10, lines 8-11].
4-12. Regarding claim 20, Gendelman-Kroyzer-Arov teach all the limitations of claim 13, wherein the anomaly is one or more of a physical intrusion to a facility housing the device, a cyberattack, or a malfunction with the device, by disclosing detecting cyber-attacks and abnormal operation [Gendelman, column 6, lines 21-24; column 10, lines 3-15, 44-51; Arov, column 6, lines 12-19, column 10, lines 8-11].
Claim Rejections - 35 USC § 103
5. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
6. Claims 8 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over anticipated by Gendelman (U.S. Patent No. 10,108,168), in view of Kroyzer et al (Pub. No. US 2016/0330225), in view of Arov et al (U.S. Patent No. 11,093,606), and further in view of DeRose et al (Pub. No. US 2006/0074513).
6-1. Regarding claims 8 and 18, Gendelman-Kroyzer-Arov teach all the limitations of claims 1 and 13 respectively. Although Gendelman-Kroyzer-Arov disclose sensing a state (e.g., on/off) of a control element [Kroyzer, paragraph 55], Gendelman-Kroyzer-Arov do not expressly teach a sensor of the plurality of non-intrusive sensors is configured to sense vibration, and wherein the sensor is physically coupled to the one or more devices and wherein the sensor detects vibration in response to the one or more devices turning on. DeRose discloses that it was well known to use a vibration sensor coupled to a device to detect when the device is in use [paragraph 28]. This would allow for better monitoring of the device. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to provide, on a device of the industrial control system of Gendelman-Kroyzer-Arov, and in addition to the data collectors on the PLCs, a vibration sensor that is physically coupled to a device being monitored, as taught by DeRose. This would allow for better monitoring of the device, thus improving the accuracy of anomaly detection of Gendelman-Kroyzer-Arov.
Response to Arguments
7. The Examiner acknowledges the Applicant’s amendments to claims 1-3 and 13-14.
Regarding independent claim 1, Applicant alleges that Gendelman (U.S. Patent No. 10,108,168) in view of Kroyzer et al (Pub. No. US 2016/0330225) do not teach of suggest “wherein the computing device determines the anomaly in response to a difference between the data associated with the monitored activities from the plurality of non-intrusive sensors and data from one or more components in a supervisory control and data acquisition system (SCADA) exceeding a threshold,” as has been amended to the claim, because Gendelman compares current data from the hardware data collectors against a learned baseline derived from historical data from the hardware data collectors, and against data from the SCADA. Examiner has rejected claim 1 under 35 U.S.C. 103 as being unpatentable over Gendelman (U.S. Patent No. 10,108,168) in view of Kroyzer et al (Pub. No. US 2016/0330225), and further in view of Arov et al (U.S. Patent No. 11,093,606). Applicant’s arguments have been considered but are moot in view of the new grounds of rejection.
Similar arguments have been presented for independent claim 13 and thus, Applicant’s arguments are not persuasive for the same reasons. is an acoustic sensor a type of vibration sensor?
Applicant states that dependent claims 1-7, 9-17, and 19-20 recite all the limitations of the independent claims, and thus, are allowable in view of the remarks set forth regarding independent claims 1 and 13. However, as discussed above, Gendelman, in view of Kroyzer, and further in view of Arov are considered to teach claims 1 and 13, and consequently, claims 1-7, 9-17, and 19-20 are rejected.
Conclusion
8. Any inquiry concerning this communication or earlier communications from the examiner should be directed to ALVIN H TAN whose telephone number is (571)272-8595. The examiner can normally be reached M-F 10AM-6PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Scott Baderman can be reached at 571-272-3644. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ALVIN H TAN/Primary Examiner, Art Unit 2118
