2, 4
DETAILED ACTION
This action is responsive to the Applicant's amendments filed on 06/26/26. Claims 1-6 remain pending in the application. Claim 1 is amended and claim 3 is cancelled. Any examiner's note, objection, and rejection not repeated is withdrawn due to Applicant's amendment.
Examiner's Note
The Examiner cites columns, paragraphs, figures, and line numbers in the references as applied to the claims below for the convenience of the applicant. Although the specified citations are representative of the teachings in the art and are applied to the specific limitations within the individual claim, other passages and figures may also apply. It is respectfully requested that, in preparing responses, the Applicant fully consider the references in its entirety as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the Examiner.
Response to Arguments
Applicants’ arguments filed 06/26/26 have been fully considered but some are not persuasive. Applicant's arguments are summarized below:
Applicants’ Argument:
Iizuka does not convert each individual byte of a packet into a vector representing a characteristic of that specific byte's value, therefore, Iizuka's "vectors" are merely arrays of aggregate network statistics (e.g., total number of packets, total number of bytes) used to estimate a network-wide "packet loss rate." Further Iizuka fails to describe or suggest converting each byte of packet data into vector data, nor does Iizuka teach estimating an abnormal byte within a specific abnormal packet based on byte-by- byte vector similarity.
Examiner's Response:
The Examiner respectfully disagrees: Iizuka clearly describes that in a network analysis device extracts, from the training data that is aggregated data of the previous network analysis data, training data including vectors of the explanatory variables (e.g., the number of packets and the number of bytes) which are within a predetermined distance from vectors of the explanatory variables related to the communication amount in the current network analysis data, and uses the extracted training data as the local model (S10). For example, the training data is vectors of two explanatory variables (e.g., the number of packets and the number of bytes) and one objective variable (e.g., packet loss rate), and further in FIG. 5 illustrates a space INF_VCT of two-dimensional vectors of the number of packets and the number of bytes serving as the explanatory variables, which is taken with respect to a vertical axis representing the objective variable (packet loss rate) of the training data. First, the network analysis device places previous training data sets L_DATA on the graph of FIG. 5. Then, the network analysis device uses the vectors of the explanatory variables (the number of packets and the number of bytes) in the current network analysis data as a query QRY in the vector space INF_VCT. The network analysis device extracts training data including the explanatory variable vectors within the predetermined distance from the query QRY and uses the extracted training data as a local model LCL_M, for example, the predetermined distance mentioned herein is an L2 norm or the like. Then, the processor uses vectors having, as elements, the number of packets and the number of bytes serving as the explanatory variables in the aggregated data DB3_2 of the current network analysis data as the query QRY, extracts the training data L_DATA/LCL including vectors within a given distance from the query, and uses the training data L_DATA/LCL as the local model LCL_M (S10 in FIG. 4). Then, the processor adds, to the estimated value LOSS_SP of the packet loss rate, the normal range No obtained by multiplying the standard deviation o indicating the dispersion of the packet loss rate in the training data of the local model by the factor N to thus calculate the abnormality determination threshold LOSS_TH (S12 in FIG. 4). In addition, the processor determines whether or not a measured value of the packet loss rate in the current aggregated data is over the abnormality determination threshold LOSS_TH (S13 in FIG. 4). When the measured value of the packet loss rate is over the abnormality determination threshold LOSS_TH, the processor determines that the network is currently in an abnormal state (S14 in FIG. 4). When the measured value of the packet loss rate is equal to or smaller than the abnormality determination threshold LOSS_TH, the processor determines that the network is currently in a normal state (S15 in FIG. 4). The measured value of the packet loss rate in the current aggregated data corresponds to a value of the packet loss rate in the aggregated network analysis data DB3, _2 in FIG. 26, which is an average value of the respective packet loss rates in the plurality of connections in the plurality of connection groups in the conditionally extracted network analysis data DB3_1. Returning to FIG. 10, when an abnormality is detected in the JIT analysis (YES in S26), the processor performs the alarm determination processing step S27. When an alarm asking feedback is generated (YES in S28) and a feedback from the administrator indicates that the alarm is unneeded (inadequate) (YES in S29), the processor increases the factor value N to adjust the normal range No to a larger size (S30). When an alarm asking feedback is not generated (NO in S28) or when there is no feedback indicating that the alarm is unneeded (inadequate) (NO in S29), the processor does not adjust the normal range. The processor selects the next determination target item in FIG. 24 and performs the same processing until abnormality determination for all the determination target items in FIG. 24 is ended (YES in S31) (see col. 13, lines 29-67 to col. 14, lines 1-42)
Therefore, the concepts are taught in Iizuka’s reference to the extent required by the actual claim language. Further, the interpretation of the claim language must be as broad as possible for the given art. If the Applicant needs a specific interpretation of the claim language, these details must be imported into the claims. These details cannot be read into the claim language when the claim language is so broad as to encompass other valid interpretations. The examiner would also like to point out that it is known that converting packet data to a vector data is changing raw network traffic into a list of number and this number is a “vector” to provide computers to analyze data. Therefore, the argument has been considered but found not convincing and considering the above, the final rejection holds strong in view of the recited reference (Iizuka).
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102
and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the
statutory basis for the rejection will not be considered a new ground of rejection if the prior art
relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis
for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless -
(a)(2) the claimed invention was described in a patent issued under section 151, or in an
application for patent published or deemed published under section 122(b), in which the
patent or application, as the case may be, names another inventor and was effectively
filed before the effective filing date of the claimed invention.
Claims 1-6 are rejected under 35 U.S.C. 102(a) (2) as being anticipated by Iizuka et al.
"Herein Iizuka" (U.S. PN: 11,507,076).
As per claims 1 and 5:
Iizuka substantially teaches estimation method and apparatus (see col. 5, lines 34-50)
comprising a conversion unit comprising one more processor, configured to convert abnormal
packet data into abnormal vector data using a model that converts packet data into vector data in
which each byte of the packet data is associated with each vector representing a characteristic of
a value of each byte extracting normal vector data having a relatively high similarity to the abnormal vector data from among a plurality of pieces of normal vector data obtained by converting a plurality of pieces of normal packet data using the model; (see col. 6, lines 32-67 to col. 7, lines 1-21, and col. 9, lines 36-43) and estimating an abnormal byte in the abnormal packet data from a similarity between a vector corresponding to each byte of the abnormal vector data and a vector corresponding to each byte of the extracted normal vector data, wherein the similarity is calculated between the vector of the abnormal vector data and the vector of the normal vector data and the vector of the normal data for each byte of the abnormal vector data (see col. 7, lines 22-36, col. 9, lines 36-43 and col. 13, lines 29-67 to col. 14, lines 1-42)
As per claim 2, Iizuka teaches wherein the model is generated by learning a value of each
byte of a plurality of pieces of normal packet data (see col. 6, lines 32-67 to col. 7, lines 1-21,
and col. 9, lines 36-43).
As per claim 4, Iizuka teaches wherein in a case where a highest similarity among
similarities between a vector corresponding to a predetermined byte of the abnormal packet data
and a vector corresponding to each byte of the extracted normal vector data is lower than a
predetermined threshold, the estimation unit estimates the predetermined byte as abnormal
byte (see col. 6, lines 32-67 to col. 7, lines 1-21, and col. 9, lines 36-43).
As per claim 6, Iizuka teaches a non-transitory, computer-readable medium storing one or
more instructions executable by a computer to perform operations as the estimation apparatus
(see col. 3, lines 7-10).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicants’
disclosure.
Oba (U.S. PN: 11962479) teaches based on the abnormality degree of detection target
Packet stream 20 that has been calculated by information calculator 27, determiner 28 determines whether detection target packet stream 20 is abnormal. Subsequently, determiner 28 outputs determiner 28 outputs the determination results to the outside of determiner 28. For example, determiner 28 may store a threshold value, and when the abnormality degree of detection target packet stream 20 is greater than or equal to the threshold value, determiner 28 may determine that detection target packet stream 20 is abnormal, and when the abnormality degree of detection target packet stream 20 is less than the threshold value, determiner 28 may determine that detection target packet stream 20 is not abnormal.
Gupta et al. (U.S. PN: 12,021,720) in FIG. 3, teaches training controller 204 includes the
example feature extractor 304 to generate a feature vector based on pre-processed packet
samples and features from the example pre-processor 302. The example feature extractor 304 generates or builds derived values of feature vectors (e.g., representative off features in n packet samples) that are to be informative and non-redundant to facilitate the training pha of the training controller 204. As used herein, a feature vector is an n-dimensional array (e.g., a vector) of features that represent some workload category. For example, a feature could be one of the f features such as inter-packet arrival time, protocol identifier, packet direction, source and destination, packet length (e.g., bit size), QoS, etc. For example, the network packet controller 202 of FIG. 2 captures a plurality of network data packets from the network 102 corresponding to a video call. In such an example, the feature extractor 304 extracts data packet features and generates vectors for the data packets and provides the vectors to the model trainer 308.
Conclusion
Applicants’ amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicants are reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for replying to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ESAW T ABRAHAM whose telephone number is (571)272-3812. The examiner can normally be reached on 8AM-4:30PM EST M-F.
If attempts to reach the examiner by telephone are unsuccessful, the examiner'ssupervisor, Albert DeCady can be reached on (571) 272-3819. The fax phonenumber for the organization where this application or proceeding is assigned is(703) 872-9306.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ESAW T ABRAHAM/Primary Examiner,
Art Unit 2112
Prosecution Insights