DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This action is responsive to communication filed on 5/7/2026.
Claims 1-14, 16-21 are subject to examination.
This amendment and applicant’s arguments have been considered and entered by the Examiner.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-2, 6, 20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Tsalakopoulous et al. U.S. Patent Publication # 2006/0184371 (hereinafter Tsal) in view of Vescio et al. U.S. Patent Publication # 2020/0050986 (hereinafter Vescio) further in view of Apger et al. U.S. Patent Publication # 2023/0139000 (hereinafter Apger) further in view of Abou Shousha et al. U.S. Patent Publication # 2020/0035362 (hereinafter Abou)
With respect to claim 1, Tsal teaches a method, comprising:
-obtaining, by a computing device, a plurality of risk events (Paragraph 75, 77, 86-87)
-mapping, by the computing device, treatment actions to each of the plurality of the risk events (Paragraph 77-79, 86-87, 107-109)
-determining, by the computing device, an impact of the treatment actions on each of the plurality of the risk events (Fig. 11)(Paragraph 95, 105, 107-109);
determining, by the computing device, a probability (i.e. likelihood) of implementation of the treatment actions (Paragraph 95-97, 107-109)
-calculating, by the computing device, how the treatment actions affect other risk factors (Paragraph 130) based on the determining steps; and
-providing, by the computing device, a recommendation of optimal risk mitigation based on how the first treatment actions affect the other risk events (Paragraph 95-96)
Although Tsal teaches calculating, by the computing device, how the treatment actions affect other risk factors (Paragraph 130) but Tsal does not teach based on the determining steps and wherein each of the plurality of risk events is associated with a potential threat or a vulnerability to information technology infrastructure.
Vescio teaches obtaining by a computing device, a plurality of risk events (Paragraph 102, 103), wherein each of the plurality of risk events (i.e. residual risk reports, residual risk summary, implicit risk etc.)(Paragraph 102-105) is associated with a potential threat or a vulnerability to information technology infrastructure (i.e. a residual risk report may include breakdown of risks faced by each asset group of the business, in a risks per asset group includes risk scores for each systems for example, servers and apps, business networks, end user systems, terminals etc.)(Paragraph 102-103, 104); calculating, by the computing device, how the treatment actions affect other risk factors (Paragraph 68) based on determining, by the computing device, a probability of implementation of the treatment actions (Paragraph 65). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Vescio’s teaching in Tsal’s teaching to come up with calculating how the treatment actions affect other risk factors based on probability of implementations. The motivation for doing so would be to come up with and be ready with appropriate remedial action for corrective measure therefore the impact is minimized and controlled.
Although, Vescio teaches wherein each of the plurality of risk events (i.e. residual risk reports, residual risk summary, implicit risk etc.)(Paragraph 102-105) is associated with a potential threat or a vulnerability to information technology infrastructure (i.e. a residual risk report may include breakdown of risks faced by each asset group of the business, in a risks per asset group includes risk scores for each systems for example, servers and apps, business networks, end user systems, terminals etc.)(Paragraph 102-103, 104); Apger explicitly teaches wherein each of the plurality of risk events is associated with a potential threat or a vulnerability (i.e. plurality of event records wherein notable event record is indicative of a potential security threat associated with a respective entity on the computer network, wherein the notable event record contains an association of the respective entity with a risk object) to information technology infrastructure (i.e. computer network) (Paragraph 292, 301). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Apger’s teaching in Tsal and Vescio’s teaching to come up with having plurality of risk events is associated with a potential threat or a vulnerability to information technology infrastructure. The motivation for doing so would be to outputting the threat report for display to the user and the administrator to take corrective action beforehand.
Tsal, Vescio and Apger does not explicitly state mapping treatment action to each of the plurality of risk events based on an association between risk events and the treatment actions wherein each treatment action includes a score comprising a positive effect of a negative effect on an initial risk.
Abou teaches mapping treatment action to each of the plurality of risk events based on an association between risk events (i.e. condition scores may correspond to a risk, severity, action or treatment outcome) and the treatment actions wherein each treatment action includes a score comprising a positive effect of a negative effect on an initial risk (i.e. score may indicate positive or negative treatment ) (Paragraph 78). It would have been obvious to one of ordinary skill in the art before effective filing date of the claimed invention to implement Abou’s teaching in Tsal, Vescio and Apger’s teaching to come up with mapping treatment action based on association between risk events and score comprising positive or negative effect. The motivation or doing so would to conclude if the treatment is working based on the score therefore, appropriate action can be take place or shall continue with respect to treatment.
With respect to claim 2,Tsal, Vescio, Apger and Abou teaches the method of claim 1, but Vescio further teaches wherein the calculating is a residual function to create an optimal plan of improvement of risk reduction (Paragraph 95-96)
With respect to claim 6, Tsal, Vescio, Apger and Abou teaches the method of claim 2, but Tsal further teaches wherein the residual function comprises a residual risk assessment which considers all possible scenarios of treatment actions subsequent to an implementation on the risk events (Paragraph 95-96, 104-105, 107-108)
With respect to claim 20, Tsal teaches system comprising: a processor, a computer readable memory, one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to: obtain, by a computing device, a plurality of risk events (Paragraph 75, 77, 86-87)
map, by the computing device, treatment actions to each of the plurality of the risk events (Paragraph 77-79, 86-87, 107-109)
determine, by the computing device, an impact of the treatment actions on each of the plurality of the risk events (Fig. 11)(Paragraph 95, 105, 107-109);
determine, by the computing device, a probability of implementation of the treatment actions (Paragraph 95-97, 107-109)
calculate, by the computing device, how a first treatment action on a first risk of the plurality of risk events affects other risk factors (Paragraph 130); and provide, by the computing device, a recommendation of optimal risk mitigation based on how the first treatment action on the first risk of the plurality of risk events affects the other risk events (Paragraph 95-96)
Although Tsal teaches calculating, by the computing device, how the treatment actions affect other risk factors (Paragraph 130) but Tsal does not teach based on the determining steps and wherein each of the plurality of risk events is associated with a potential threat or a vulnerability to information technology infrastructure.
Vescio teaches obtaining by a computing device, a plurality of risk events (Paragraph 102, 103), wherein each of the plurality of risk events (i.e. residual risk reports, residual risk summary, implicit risk etc.)(Paragraph 102-105) is associated with a potential threat or a vulnerability to information technology infrastructure (i.e. a residual risk report may include breakdown of risks faced by each asset group of the business, in a risks per asset group includes risk scores for each systems for example, servers and apps, business networks, end user systems, terminals etc.)(Paragraph 102-103, 104); calculating, by the computing device, how the treatment actions affect other risk factors (Paragraph 68) based on determining, by the computing device, a probability of implementation of the treatment actions (Paragraph 65); measure by the computing device, an effect of implementing the recommendation through a set of continual service improvement processes that is fed back to the computing device to minimize residual risk assessment error (i.e. first analysis and second analysis wherein if a second analysis of a business is conducted after a first analysis has been conducted and a first set of recommendations have been generated for a business, the threat likelihood values of the second analysis may include threat likelihood values representing changes in how attacks have been performed since the time the first recommendations were generated)(Paragraph 112-113) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Vescio’s teaching in Tsal’s teaching to come up with calculating how the treatment actions affect other risk factors based on probability of implementations. The motivation for doing so would be to come up with and be ready with appropriate remedial action for corrective measure therefore the impact is minimized and controlled.
Although, Vescio teaches wherein each of the plurality of risk events (i.e. residual risk reports, residual risk summary, implicit risk etc.)(Paragraph 102-105) is associated with a potential threat or a vulnerability to information technology infrastructure (i.e. a residual risk report may include breakdown of risks faced by each asset group of the business, in a risks per asset group includes risk scores for each systems for example, servers and apps, business networks, end user systems, terminals etc.)(Paragraph 102-103, 104); Apger explicitly teaches wherein each of the plurality of risk events is associated with a potential threat or a vulnerability (i.e. plurality of event records wherein notable event record is indicative of a potential security threat associated with a respective entity on the computer network, wherein the notable event record contains an association of the respective entity with a risk object) to information technology infrastructure (i.e. computer network) (Paragraph 292, 301). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Apger’s teaching in Tsal and Vescio’s teaching to come up with having plurality of risk events is associated with a potential threat or a vulnerability to information technology infrastructure. The motivation for doing so would be to outputting the threat report for display to the user and the administrator to take corrective action beforehand.
Tsal, Vescio and Apger does not explicitly state mapping treatment action to each of the plurality of risk events based on an association between the plurality of risk events and the treatment actions wherein each treatment action includes a score comprising a positive effect of a negative effect on an initial risk.
Abou teaches mapping treatment action to each of the plurality of risk events based on an association between risk events (i.e. condition scores may correspond to a risk, severity, action or treatment outcome) and the treatment actions wherein each treatment action includes a score comprising a positive effect of a negative effect on an initial risk (i.e. score may indicate positive or negative treatment ) (Paragraph 78). It would have been obvious to one of ordinary skill in the art before effective filing date of the claimed invention to implement Abou’s teaching in Tsal, Vescio and Apger’s teaching to come up with mapping treatment action based on association between risk events and score comprising positive or negative effect. The motivation or doing so would to conclude if the treatment is working based on the score therefore, appropriate action can be take place or shall continue with respect to treatment.
Claim(s) 4-5, 11-12 is/are rejected under 35 U.S.C. 103 as being unpatentable over Tsalakopoulous et al. U.S. Patent Publication # 2006/0184371 (hereinafter Tsal) in view of Vescio et al. U.S. Patent Publication # 2020/0050986 (hereinafter Vescio) further in view of Apger further in view of Abou Shousha et al. U.S. Patent Publication # 2020/0035362 (hereinafter Abou) further in view of in view of Sahni et al. U.S. Patent Publication # 2024/0037476 (hereinafter Sahni)
With respect to claim 4, Tsal, Vescio, Apger and Abou teaches the method of claim 2, but fails to further teaches further comprising determining a factorization of the risk events.
Sahni teaches determining a factorization of the risk events (Paragraph 23-24). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Sahni’s teaching in Tsal, Vescio, Apger and Abou’s teaching to come up with determining a factorization of the risk events. The motivation for doing so would be to apply weights and see how the scale changes.
With respect to claim 5, Tsal, Vescio, Apger, Abou and Sahni teaches the method of claim 4, but Sahni further teaches wherein the factorization is a set of risks to determine and mitigate an impact on risk uncertainty of a treatment action (Paragraph 23-24).
With respect to claim 11, Tsal, Vescio, Apger, Abou and Sahni teaches the method of claim 2, but Tsal further teaches further comprising iteratively repeating the mapping step, determining steps and calculating step to learn how the treatment actions affect the other risk factors to further refine the recommendation of the optimal risk mitigation(Paragraph 111-113) but does not teach learning using machine learning.
Sahni teaches learning using machine learning (Paragraph 46). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Sahni’s teaching in Tsal, Vescio, Apger, Abou and Shani’s teaching to come up with calculating to learn using machine learning how the treatment actions affect the other risk factors to further refine the recommendation of the optimal risk mitigation. The motivation for doing so would be provide best/optimal solutions based on machine learning and AI that can form plans and to make decisions to achieve their goals.
With respect to claim 12, Tsal, Vescio, Apger, Abou and Sahni teaches the method of claim 2, but fails to further teaches wherein the computing device includes software provided as a service in a cloud environment. Sahni teaches wherein the computing device includes software provided as a service in a cloud environment (Paragraph 44). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Sahni’s teaching in Tsal, Vescio, Apger and Abou’s teaching to come up with using software provided as service in a cloud environment. The motivation for doing so would be so the computing device can be assess remotely and remedy can be provided remotely.
Allowable Subject Matter
Claims 13-14, 16-19 are allowed.
Claim 3, 7-10, 21 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Response to Arguments
Applicant’s arguments have been considered but deemed moot in view of new grounds of rejection.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
A). Duessel et al. U.S. Patent Publication # 2022/0366332 which teaches about risk-adaptive security investment optimization.
B). Murray et al. U.S. Patent Publication # 2021/0367963 which teaches about real-time compliance monitoring for automated risk assessment.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DHAIRYA A PATEL whose telephone number is (571)272-5809. The examiner can normally be reached M-F 7:30am-4:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kamal B Divecha can be reached on 571-272-5863. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
DHAIRYA A. PATEL
Primary Examiner
Art Unit 2453
/DHAIRYA A PATEL/Primary Examiner, Art Unit 2453
Prosecution Insights