Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-25 are now pending in the application under prosecution and have been examined.
Response to Arguments
Applicant’s arguments with respect to claims 1-25 have been considered but are moot in view of new ground of rejection.
Claims 1-25 are rejected under 35 U.S.C. 103 as being unpatentable over US20230316196 (SEWAK et al) in view of US 20220245461 (SERN et al).
With respect to claims 1, 8, 15, 22, and 25 SEWAK teaches system, computer-implemented method, system comprising: a memory having computer readable instructions; and one or more processors for executing the computer readable instructions, the computer readable instructions controlling the one or more processors to perform operations (system for generating an integrated classifier model integrating functions as being performed by at least one entity carried out by hardware, firmware, and/or software, the functions carried out by a processor executing instructions stored in memory) [Abstract; Par. 0087] comprising: inputting, by a processor, records to a machine learning model [receiving a digital record that encodes content for generating model hierarchies and compliance enforcement Par. 0051]; and classifying, by the processor, the records with labels using the machine learning model (plurality of models including integrated classifier model that includes a classifier model that detect classification based on a first lexicon), the machine learning model abstaining from classifying a given record in response to the given record being outside of a scope of the generated model (the classifier featuring determining that the content violates a policy of the system based on an analysis of the record by each of a plurality of models that are arranged in a nested structure (i.e., record not classified or record belonging to a negative class of the integrated classifier model leading to performing mitigation action quarantining the record from the system) [Par. 0035-0036].
SEWAK fails to specifically teach blocking the given record from being transferred to an automated resolution system that is configured to modify at least one component in an IT environment, based on the machine learning model abstaining from classifying the given record. However SERN teaches method for detecting Domain Generation Algorithm (DGA) behaviors using a system comprising a deep learning classifier (DL-C) module to obtain a time series of DGA occurrences or records; a series filter-classifier (SFC) module identifying records un-associated with the identified NXDOMAIN DGA DNS records to a finding successful resolutions (FSR) module; the finding successful resolutions (FSR) module removing series (records) having coherence scores below a predefined threshold, i.e., removing remove domain names that are not associated with known DGAs from the DNS records (corresponding DNS records that do not exhibit similar DGA characteristics as determined by the DL-C module) [Par. 0023-0028; Par. 0032-0034; Par. 0132-0141; Par. 0146-0153].
Therefore, it would have been obvious to one having ordinary skill in the art before the effective filing of the instant application to feature blocking given records from being transferred to an automated resolution system taught by SERN, within the generated model featuring compliance enforcement, as taught by SEWAK, in order to use machine-learning application analysis focused on extracting engineered time domain features to realize a working system as their analysis required actual malware samples which isn't easily obtained and would not work if visibility is constrained only to network traffic data, as taught by SERN [Par. 0010-0011].
With respect to claims 2, 9, 16, and 23, SEWAK and SERN, combined, teach system, computer-implemented method, wherein the machine learning model identifies the given record outside of the IT domain as unclassified
(compliance monitor employing record inspector to classify each incoming record that detects record not belonging to a classification (or negative classification) requiring intervention / mitigations) [SEWAK’s Par. 0034-0035]
(machine learning string analyzer (ML-SA) module, based on a machine learning algorithm, the DNS records to identify domain names that are not associated with known DGAs from the DNS records [Par. 0032-0034].
With respect to claims 3, 10, and 17, SEWAK and SERN, combined, system, computer-implemented method, wherein the machine learning model is trained on training data in the IT domain (receiving a digital record that encodes content, plurality of models analyzed and labeled as belonging to integrated classifier model) SEWAK’s [Par. 0002-0003].
With respect to claims 4, 11, and 18, SEWAK and SERN, combined, system, computer-implemented method, wherein: the machine learning model is trained by receiving input of training data comprising training records and corresponding training labels to the training records; and the machine learning model is trained to abstain from classifying any record outside of the IT domain
(classifier featuring determining that the content violates a policy of the system based on an analysis of the record by each of a plurality of models that are arranged in a nested structure (i.e., record not classified or record belonging to a negative class of the integrated classifier model leading to performing mitigation action quarantining the record from the system) [SEWAK’s Par. 0035-0036]
(machine learning string analyzer (ML-SA) module, based on a machine learning algorithm, the DNS records to identify domain names that are not associated with known DGAs from the DNS records, for the system removing series (records) having coherence scores below a predefined threshold, i.e., removing remove domain names that are not associated with known DGAs from the DNS records [SERN’s Par. 0023-0028; Par. 0032-0034; Par. 0132-0141; Par. 0146-0153].
.
With respect to claims 5, 12, and 19, SEWAK and SERN, combined, system, computer-implemented method, wherein the records and the labels are transferred to the automated resolution system (a finding successful resolutions (FSR) module makes use of the characteristics of each series, as determined by the SFC module, to find DGA domain names that resolved to possible Command and Control (C2) servers, the machine learning algorithms to first flag out strings that may be potential DGAs classifying domain name or a series of domain names constitute DGA or not, and does not carry out any analysis on the type of DGA characteristics) [SERN’s Par. 0061-0064; Par. 0031-0034].
With respect to claims 6, 13, and 20, SEWAK and SERN, combined, system, computer-implemented method, wherein blocking the given record from being transferred to the automated resolution system prevents any component in the IT environment from being modified based on an incorrect classification of the given record
(record of a plurality of models that are arranged in a nested structure (i.e., record not classified or record belonging to a negative class of the integrated classifier model leading to performing mitigation action quarantining the record from the system) [SEWAK’s Par. 0035-0036]
(machine learning string analyzer (ML-SA) module, based on a machine learning algorithm, the DNS records to identify domain names that are not associated with known DGAs from the DNS records, the system removing series (records) having coherence scores below a predefined threshold, i.e., removing remove domain names that are not associated with known DGAs from the DNS records (corresponding DNS records that do not exhibit similar DGA characteristics as determined by the DL-C module) [SERN’s Par. 0023-0028; Par. 0032-0034; Par. 0146-0153].
.
With respect to claims 7, 14, and 21, SEWAK and SERN, combined, system, computer-implemented method, wherein: the machine learning model comprises a linear classifier algorithm; and the records are tickets of technical problems in the IT environment
(classifier featuring determining that the content violates a policy of the system based on an analysis of the record by each of a plurality of models that are arranged in a nested structure (i.e., record not classified or record belonging to a negative class of the integrated classifier model leading to performing mitigation action quarantining the record from the system) [SEWAK’s Par. 0035-0036];
(machine learning string analyzer (ML-SA) module, based on a machine learning algorithm, the DNS records to identify domain names that are not associated with known DGAs from the DNS records [SERN’s 0032-Par. 0034].
With respect to claim 24, SEWAK and SERN, combined system, computer-implemented method, wherein the linear classifier algorithm is trained on training data in the IT domain, the linear classifier algorithm being further trained on pertinent positive features for the labels without pertinent negative features, the pertinent positive features for the labels having been verified (record of a plurality of models that are arranged in a nested structure (i.e., record not classified or record belonging to a negative class of the integrated classifier model leading to performing mitigation action quarantining the record from the system) [SEWAK’s Par. 0035-0036].
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
GB 2603279 A (CHAN et al) teaching deep learning classifier (DL-C) module filters the stream of DNS records before the filtered DNS records, which have been determined to possess domain names that exhibit DGA behavior are provided to a series filter-classifier (SFC) module. The SFC module then groups the records into various series based on source IP, destination IP and time. For each series, it then filters away records that do not exhibit the dominant DGA characteristics of the series..
US 20210049512 A1 (CHATTERJEE et al) teaching transformed record containing a modified version of a corresponding training record, as well as the prediction made for the training record by the classifier, a particular matching rule selected to provide an easy-to-understand explanation for a prediction made by the classifier for an observation record which is not part of the training set.
US 10621550 B2 (CAREY et al ) teaching a cloud-based system for the trusted storage and analysis of genetic and other information, the system to include or support some or all of authenticated and certified data sources; authenticated and certified diagnostic tests; and policy-based access to data.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Contact Information
Any inquiry concerning this communication or earlier communications from the examiner should be directed to PIERRE MICHEL BATAILLE whose telephone number is (571)272-4178. The examiner can normally be reached Monday - Thursday 7-6 ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, TIM VO can be reached at (571) 272-3642. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/PIERRE MICHEL BATAILLE/Primary Examiner, Art Unit 2136
Prosecution Insights