DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
All previous objections and rejections directed to the Applicant’s disclosure and claims not discussed in this Office Action have been withdrawn by the Examiner.
Response to Amendments and Arguments
The 101 and 112 rejections have been remedied and thus removed.
The applicant’s amendments with respect to claim 1 have been carefully considered, but are not persuasive. Claim 1 has been amended with language from claim 6, on which Ringlein et al. reads. Claim 1 is further amended with perform corrective action based on the detected credentials for data loss prevention” on which the examiner determines that Ringlein et al., para [0094], reads.
An additional reference (Davidson et al.) has been introduced to read on amended claim 5.
Claim Rejections – 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-3, 6-10, 13-16, and 17-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over “Character-level Convolutional Networks for Text Classification”, hereinafter referred to as Zhang et al., in view of US 20200401696, hereinafter referred to as Ringlein et al.
Regarding claim 1, Zhang et al. discloses a method comprising:
training a convolutional neural network to detect credentials in documents (“We show that when trained on largescale datasets, deep ConvNets do not require the knowledge of words, in addition to the conclusion from previous research that ConvNets do not require the knowledge about the syntactic or semantic structure of a language,” Zhang et al., sec. 1, 2nd set of highlighted sentences.),
wherein training the convolutional neural network comprises,
identifying a plurality of documents and a plurality of labels We then labeled each piece of news using its URL, by manually classifying the their domain names. This gives us a large corpus of news articles labeled with their categories,” Zhang et al., sec 4, highlighted sentences.);
augmenting the plurality of documents with natural language processing to generate a plurality of augmented documents at least comprising the plurality of documents (“As a result, the most natural choice in data augmentation for us is to replace words or phrases with their synonyms. We experimented data augmentation by using an English thesaurus, which is obtained from the mytheas component used in LibreOffice1 project,” Zhang et al., sec. 2.4, highlighted sentences.); and
training the convolutional neural network with the plurality of augmented documents and the plurality of labels (“Word-based ConvNets. Among the large number of recent works on word-based ConvNets for text classification, one of the differences is the choice of using pretrained or end-to-end learned word representations…To ensure fair comparison, the models for each case are of the same size as our character-level ConvNets, in terms of both the number of layers and each layer's output size. Experiments using a thesaurus for data augmentation are also conducted,” Zhang et al., sec. 3.2, highlighted sentences. This excerpt shows that the CNN is trained prior to being deployed.); and
deploying the trained convolutional neural network (Zhang et al., Zhang et al., sec. 3.2, highlighted sentences.)
Zhang et al. does not specifically teach that the labeled data comprises credentials; deploying the trained convolutional neural network to detect credentials in documents in network contexts with potential data leakage exposure based on monitoring one or more storage media in the network contexts and perform corrective action based on the detected credentials for data loss prevention.
Ringlein et al. is cited to disclose that the labeled data comprises credentials (“This machine learning may be a supervised or unsupervised machine learning operation, such as by executing the CNN model on the extracted features/metrics for security alerts to thereby generate a disposition classification of the security incident/alert as to whether it represents a true threat requiring escalation or a false positive that should not be escalated, and then comparing the result generated by the CNN model to the correct disposition classification for the security alert as specified by the security analyst 131…The trained CNN model, i.e. the trained security incident ML model 148 may then be deployed for runtime execution on new security incidents/alerts to classify their corresponding extracted feature/metric patterns as to whether they represent true threats requiring escalation or are false positives that do not require escalation,” Ringlein et al., para [0080]. The classification of the security alert is a labelling, wherein the security alert is interpreted as a credential.);
deploying the trained convolutional neural network to detect credentials in documents in network contexts with potential data leakage exposure based on monitoring one or more storage media in the network contexts (“Once trained, the security incident ML model may be tested using a test dataset which again may comprise a set of security incidents, their corresponding security knowledge graphs, and a corresponding ground truth indication of the correct disposition for the security incident, such as may be input by a SME,” Ringlein et al., para [0040]. A security incident implies a potential data leakage.); and
perform corrective action based on the detected credentials for data loss prevention (“The prediction output is then provided to a security analyst, logged in a security alert database, and/or otherwise made available for further processing or evaluation by security analysts to handle security alerts that represent true security threats and avoid wasted resource expenditures on security alerts that are likely false positives (step 350). In addition, user feedback and/or entries in a dynamic training dataset may be generated based on the user feedback,” Ringlein et al., para [0094]. Here, a user may provide feedback to the system which will provide corrective action to the security incident disposition operations, including to future training.). Ringlein et al. benefits Zhang et al. by providing a practical application for the text classification of Zhang et al. Therefore, it would be obvious for one skilled in the art to combine the teachings of Zhang et al. with those of Ringlein et al. to integrate the character-level CCN of Zhang et al. into a security incident prediction application.
As to claim 8, CRM claim 8 and method claim 1 are related as method and CRM of using same, with each claimed element’s function corresponding to the method step. Accordingly claim 8 is similarly rejected under the same rationale as applied above with respect to method claim. Also, Ringlein et al., para [0050-[0056], teach processor, memory, CRM, and instructions.
As to claim 14, apparatus claim 14 and method claim 1 are related as method and apparatus of using same, with each claimed element’s function corresponding to the method step. Accordingly claim 14 is similarly rejected under the same rationale as applied above with respect to method claim. Also, Ringlein et al., para [0050-[0056], teach processor, memory, CRM, and instructions.
Regarding claim 2 (Original), Zhang et al., as modified by Ringlein et al., discloses the method of claim 1, wherein the credentials comprise at least one of passwords, application programming interface tokens, access tokens, user credentials, private keys, and Privacy-Enhanced Mail files (Ringlein et al., para [0062] and [0076], at least, explain how the security alert (i.e., label/classification) comprises security event data related to passwords and privacy.)
As to claim 9, CRM claim 9 and method claim 2 are related as method and CRM of using same, with each claimed element’s function corresponding to the method step. Accordingly claim 9 is similarly rejected under the same rationale as applied above with respect to method claim. Also, Ringlein et al., para [0050-[0056], teach processor, memory, CRM, and instructions.
As to claim 15, apparatus claim 15 and method claim 2 are related as method and apparatus of using same, with each claimed element’s function corresponding to the method step. Accordingly claim 15 is similarly rejected under the same rationale as applied above with respect to method claim. Also, Ringlein et al., para [0050-[0056], teach processor, memory, CRM, and instructions.
Regarding claim 3 (Original), Zhang et al., as modified by Ringlein et al., discloses the method of claim 1, wherein the convolutional neural network comprises one or more one-dimensional convolutional layers (“In this article we explore treating text as a kind of raw signal at character level, and applying temporal (one-dimensional) ConvNets to it,” Zhang et al, sec. 1, 1st set of highlighted sentences.).
As to claim 10, CRM claim 10 and method claim 3 are related as method and CRM of using same, with each claimed element’s function corresponding to the method step. Accordingly claim 10 is similarly rejected under the same rationale as applied above with respect to method claim. Also, Ringlein et al., para [0050-[0056], teach processor, memory, CRM, and instructions.
As to claim 16, apparatus claim 16 and method claim 3 are related as method and apparatus of using same, with each claimed element’s function corresponding to the method step. Accordingly claim 16 is similarly rejected under the same rationale as applied above with respect to method claim. Also, Ringlein et al., para [0050-[0056], teach processor, memory, CRM, and instructions.
Regarding claim 4 (Original), Zhang et al., as modified by Ringlein et al., discloses the method of claim 3, wherein the convolutional neural network further comprises an embedding layer prior to a first of the one or more one-dimensional convolutional layers (Zhang et al., fig. 1.), further comprising processing a document at the embedding layer and the first one-dimensional convolutional layer (Zhang et al., fig. 1.), wherein processing the document at the embedding layer and the first one-dimensional convolutional layer comprises,
truncating the document into fixed-length subdocuments (“Then, the sequence of characters is transformed to a sequence of such m sized vectors with fixed length l0. Any character exceeding length l0 is ignored,” Zhang et al., sec. 2.2, highlighted sentences.); and
for each fixed-length subdocument of the document,
one-hot encoding characters in the subdocument at the embedding layer (“Our models accept a sequence of encoded characters as input. The encoding is done by prescribing an alphabet of size m for the input language, and then quantize each character using 1-of-m encoding (or "one-hot" encoding),” Zhang et al., sec. 2.2, highlighted sentences.); and
applying a one-dimensional kernel in a sliding window to the one-hot encoding of the characters in the subdocument (Zhang et al., sec. 1, 1st group of highlighted sentences, teaches a one-dimensional CNN. And, Zhang et al., fig. 1 shows convolutions applied to the one-hot encoded (i.e., quantized) input. As the CNN is one-dimensional, the applied kernel is one-dimensional, and a convolution implies a sliding window.).
As to claim 11, CRM claim 11 and method claim 4 are related as method and CRM of using same, with each claimed element’s function corresponding to the method step. Accordingly claim 11 is similarly rejected under the same rationale as applied above with respect to method claim. Also, Ringlein et al., para [0050-[0056], teach processor, memory, CRM, and instructions.
As to claim 17, apparatus claim 17 and method claim 4 are related as method and apparatus of using same, with each claimed element’s function corresponding to the method step. Accordingly claim 17 is similarly rejected under the same rationale as applied above with respect to method claim. Also, Ringlein et al., para [0050-[0056], teach processor, memory, CRM, and instructions.
Regarding claim 6 (Currently Amended), Zhang et al., as modified by Ringlein et al., discloses the method of claim 1, wherein deploying the trained convolutional neural network to detect credentials for data loss prevention further comprises,
inputting the and their corresponding probability or confidence values as determined by the trained security incident ML model. This information will provide greater insight for the human user as to the reasoning for the recommended disposition for consideration during decision making,” Ringlein et al., para [0041].); and
indicating one or more In some illustrative embodiments, the user may be prompted to provide user feedback when a probability or confidence value associated with the security incident disposition recommendation is below a predetermined threshold, indicating that there is not a sufficient amount of confidence that the corresponding disposition recommendation is correct,” Ringlein et al., para [0043]. Thus, if the confidence value is above a threshold, the detected documents correspond to sensitive data.).
As to claim 19, apparatus claim 19 and method claim 6 are related as method and apparatus of using same, with each claimed element’s function corresponding to the method step. Accordingly claim 19 is similarly rejected under the same rationale as applied above with respect to method claim. Also, Ringlein et al., para [0050-[0056], teach processor, memory, CRM, and instructions.
Regarding claim 7 (Currently Amended), Zhang et al., as modified by Ringlein et al., discloses the method of claim 6[[5]], wherein the documents in network contexts with potential data leakage exposure comprise at least one of documents at rest, documents inline, documents used by a software-as-a-service or an infrastructure-as-a-service, and documents in use at endpoint devices (Ringlein et al., fig. 1A(138) is a security alert database comprising information for the Security Incident and Event Management (SIEM) system – i.e., a software-as-a-service.).
As to claim 13, CRM claim 13 and method claim 7 are related as method and CRM of using same, with each claimed element’s function corresponding to the method step. Accordingly claim 13 is similarly rejected under the same rationale as applied above with respect to method claim. Also, Ringlein et al., para [0050-[0056], teach processor, memory, CRM, and instructions.
As to claim 20, apparatus claim 20 and method claim 7 are related as method and apparatus of using same, with each claimed element’s function corresponding to the method step. Accordingly claim 20 is similarly rejected under the same rationale as applied above with respect to method claim. Also, Ringlein et al., para [0050-[0056], teach processor, memory, CRM, and instructions.
Claim(s) 5, 12, and 18 is/are rejected under 35 U.S.C. 103 as being unpatentable over “Character-level Convolutional Networks for Text Classification”, hereinafter referred to as Zhang et al., in view of US 20200401696, hereinafter referred to as Ringlein et al., and further in view of US 11386266, hereinafter referred to as Davidson et al.
Regarding claim 5 (Currently Amended), Zhang et al., as modified by Ringlein et al., discloses the method of claim 1, wherein augmenting the plurality of documents with natural language processing comprises at least [[one]]two of translating one or more of the plurality of documents to different languages, replacing tokens in the plurality of documents with different tokens that are semantically similar (“We experimented data augmentation by using an English thesaurus, which is obtained from the mytheas component used in LibreOffice1 project. That thesaurus in turn was obtained from WordNet [7], where every synonym to a word or phrase is ranked by the semantic closeness to the most frequently seen meaning. To decide on how many words to replace, we extract all replaceable words from the given text and randomly choose r of them to be replaced,” Zhang et al., sec. 2.4, 2nd group of highlighted sentences. This excerpt illustrates replacing tokens in the text with different tokens that are semantically similar.), rearranging tokens in sentences in the plurality of documents, and processing one or more of the plurality of documents with text summarization.
However, Zhang et al. does not additionally teach translating one or more of the plurality of documents to different languages, rearranging tokens in sentences in the plurality of documents, or processing one or more of the plurality of documents with text summarization.
Davidson et al. is cited to disclose rearranging tokens in sentences in the plurality of documents (“It should be recognized that other labels of the plurality of predefined labels can correspond to various other edit operations such as deleting a token or reordering tokens,” Davidson et al., col. 33, lines 30-33.). Davidson et al. benefits Zhang et al. by reordering tokens, thereby extending the text augmentation techniques of Zhang et al. Therefore, it would be obvious for one skilled in the art to combine the teachings of Zhang et al. with those of Davidson et al. to incorporate further data augmentation techniques for controlling generalization error in deep learning models.
As to claim 12, CRM claim 12 and method claim 5 are related as method and CRM of using same, with each claimed element’s function corresponding to the method step. Accordingly claim 12 is similarly rejected under the same rationale as applied above with respect to method claim. Also, Ringlein et al., para [0050-[0056], teach processor, memory, CRM, and instructions.
As to claim 18, apparatus claim 18 and method claim 5 are related as method and apparatus of using same, with each claimed element’s function corresponding to the method step. Accordingly claim 18 is similarly rejected under the same rationale as applied above with respect to method claim. Also, Ringlein et al., para [0050-[0056], teach processor, memory, CRM, and instructions.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ANNE L THOMAS-HOMESCU whose telephone number is (571)272-0899. The examiner can normally be reached Mon-Fri 8-6.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Bhavesh M Mehta can be reached on 5712727453. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ANNE L THOMAS-HOMESCU/Primary Examiner, Art Unit 2656