Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This Office Action is in response to the amendment filed 07/20/2026.
Claims 1-20 are pending in this application.
Claims 1,12 and 20 are independent claims.
Claims 1,10-12 and 20 are currently amended.
This Office Action is made final.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Narayan (US 2024/0039927 A1) in view of Belfiore (US 2018/0146004 A1).
As per claim 1, Narayan teaches A cyber security system for computing enhanced metrics including resource misconfiguration and risk levels associated with a plurality of cloud resources each corresponding to a logical element that performs a specific task or function within a cloud network and one or more cloud architectures formed by the plurality of cloud resources within a customer cloud environment within the cloud network, the cyber security system comprising: (Narayan [0036] Note that each of these resources 203,205, and 20 can be involved in multiple attack chains and multiple attack stages within the resource graph structure 280. For instance, the cloud compute instance 203 can be accessed by multiple IAM roles and/or other resources. The IAM role 205 can have overprivileged access to multiple data stores, virtual machines, or other resources that have security exposures. The cloud storage instance 207 can be accessed by multiple other IAM roles and/or other cloud resources. Attack chains can thus visit and revisit any of the resources 203, 205, and 207 and any additional resources depicted in the resource graph structure 280 via their corresponding misconfigurations)
a cloud resource enumeration component configured to (i) identify components making up the plurality of cloud resources in one or more cloud architectures by conducting a search operation to enumerate the plurality of cloud resources without requiring a user to initially supply an explicit list of resources making up the one or more cloud components and (ii) collect metadata associated with each of the plurality of cloud resources for storage within a storage subsystem; (Narayan Fig 4 Block 401 and Fig 5 and [0013] The attack chain analyzer initializes a recursion at an initial resource with an earliest attack stage among resources with detected misconfigurations. The attack chain analyzer then iterates [enumeration] recursively breadth-first by identifying resources accessible (adjacent) to the initial resource that also have misconfigurations (e.g., the initial resource has overprivileged access rights) that are at a further stage in the attack chain (recursion starts with resources closest in the attack chain to the initial resource). [0045] FIG. 4 is a flowchart of example operations for identifying attack chains across cloud resources. At block 401, an attack chain analyzer generates a graph structure for misconfigured cloud resources. Example operations for generating a graph structure for misconfigured cloud resources are described in detail with reference to FIG. 5. [0062] At block 505, the attack chain analyzer initializes nodes in a graph structure associated with each identified resource and corresponding metadata/attack chain stage. The attack chain analyzer can construct the graph structure such that nodes can be queried for resource metadata such as identifiers, vulnerabilities, policy misconfigurations with other resources, attack stages, etc. Each attack stage stored at a node for a resource corresponds to a stage of a malicious attack going towards the resource due to the corresponding policy misconfiguration or a stage of a vulnerability for that resource. Note that the attack stages for policy misconfigurations are associated with directed edges whereas attack stages for vulnerabilities are associated with the resources themselves. Resources can have multiple attack stages associated with multiple vulnerabilities and/or policy misconfigurations. The attack stage(s) for vulnerabilities can be stored as an ordered list in association with the resources.)
an enrichment metrics collection component configured to conduct analytics on information associated with the plurality of cloud resources in order to detect compliance or misconfiguration with policies by each of the plurality of cloud resources forming the cloud architecture, wherein the enrichment metrics collection component comprises misconfiguration determination logic configured to evaluate properties associated with each cloud resource by comparing the properties to one or more parameters associated with one or more known misconfigurations of a type corresponding to the cloud resource to determine if the cloud resource has been misconfigured; and (Narayan [0024] The cloud policy misconfigurations 123 can be generated directly from the cloud policy logs 121 by detecting predefined patterns. For instance, misconfigurations can correspond to signatures stored on the cloud policy scan engine 104 that represent misconfigurations normalized across cloud APIs. The cloud policy scan engine 104 can normalize cloud policies in the cloud policy logs 121, can compare the normalized versions to signatures (e.g., according to Levenshtein distance, exact match, etc.), and can add cloud policies matching the signatures to the cloud policy misconfigurations 123. Alternatively, the cloud policy scan engine 104 can run a cloud policy misconfiguration detection model (not depicted) on the cloud policy logs 121 (e.g., after preprocessing raw log files to extract tokens). If the cloud policy misconfiguration detection model outputs for a cloud policy a probability of being misconfigured above a threshold probability, then the cloud policy is added to the cloud policy misconfigurations 123. These are example implementations for detecting cloud policy misconfigurations from cloud policy logs. [0027] The resource relationship engine 108 also receives the cloud policy misconfigurations 123 and generates resource pair exposure characteristics 125. Example resource pair exposure characteristics 113 indicates that a resource R2 has full access to a resource R1 and that a resource R3 has full access to R2. The resource relationship engine 108 can generate resource pair exposure characteristics 125 according to corresponding APIs for cloud policies in the cloud policy misconfigurations 123. For instance, for the example cloud policy misconfiguration 111, the resource relationship engine 108 can identify the “Effect” and “Allow” fields to determine that this is an access policy and can identify the corresponding allowed resources in the “Resource” field. Alternatively, these fields can be indicated in the cloud policy misconfigurations 123 themselves when identified by the cloud policy scan engine 104 and the resource relationship engine 108 can analyze the identified fields to determine the characteristics of the misconfigured policy. The resource relationship engine 108 can additionally indicate resource configurations such as resource types, exposed ports, etc. in the resource pair exposure characteristics 125 and can include severity metrics that depend on types of exposed resources, breadth of resource exposure (e.g., number of resources with overprivileged access to a resource), importance of exposed ports, etc and [0038] In some embodiments, resources with corresponding misconfigurations with a severity metric above or equal to a threshold (e.g., low) are flagged and resources with misconfigurations having a severity metric below a threshold (e.g., benign) are not flagged. Resources can have multiple severity metrics corresponding to multiple policy misconfigurations and/or resource vulnerabilities. Each of these misconfigurations can correspond to distinct severity metrics and respective thresholds for flagging each misconfiguration, and flagging can comprise indicating misconfigurations to be remediated.)
Narayan does mention values being attached to these risks (i.e vulnerabilities [0025] The cloud policy scan engine 104 communicates the cloud policy misconfigurations 123 to the incident management system 106 and the resource relationship engine 108. The incident management system 106 receives the cloud policy misconfigurations 123 and generates resource vulnerabilities 127. The incident management system 106 can analyze resources indicated in the cloud policy misconfigurations 123 to determine the resource vulnerabilities 127. The analyzed resources can include multiple resources indicated within each cloud policy misconfiguration corresponding to overprivileged access rights, open ports, known malware having vulnerability exploits for certain types of resources, etc. Certain resources can be flagged as having access to or containing sensitive data, whereas other resources can be flagged as having access to or containing publicly accessible data. Accordingly, the incident management system 106 can deem certain resource vulnerabilities as benign and can refrain from including these resources in the resource vulnerabilities 127 or can add them with a “benign vulnerability” label. In some embodiments, benign resource vulnerabilities can be tracked over time to determine whether security risk escalates due to increased resource exposure).
Narayan does not teach a risk assessment component configured to determine an estimated risk value associated with each cloud resource and each cloud architecture of the one or more cloud architecture, wherein the risk value represents a potential risk of the cloud resource or the cloud architecture being subjected to a cyber threat or compromised by a cyberattack associated with the cyber threat, wherein the cloud resource enumeration component, the enrichment metrics collection component, and the risk assessment component cooperate to detect the cyber threat or compromised by the cyberattack associated with the cyber threat.
However, Belfiore teaches a risk assessment component configured to determine an estimated risk value associated with each cloud resource and each cloud architecture of the one or more cloud architecture, wherein the risk value represents a potential risk of the cloud resource or the cloud architecture being subjected to a cyber threat or compromised by a cyberattack associated with the cyber threat, wherein the cloud resource enumeration component, the enrichment metrics collection component, and the risk assessment component cooperate to detect the cyber threat or compromised by the cyberattack associated with the cyber threat. (Belfiore [0043] The cyber control evaluation module 130, in some implementations, analyzes the client IT infrastructure profile 135 to identify IT controls applied to a set of predetermined security domains 132. Additionally, the cyber control evaluation module 130 can determine a target control performance which can be based on the threat profile 125. The vulnerability assessment 140 can be determined as a function of comparing the target control performance against the current control performance for each relevant security domain 132. More specifically, the vulnerability assessment 140 can be calculated across each of the predetermined security domains as the predetermined security domains relate to a specific threat to a technology asset [resource] identified in the threat profile 125. Additionally, a threat-specific control environment can be defined based on the target control performance and the current control performance relating to controls specific to the threat scenarios identified in the threat profile 125 (including threat vectors). As a result of the threat specific control environment, the vulnerability assessment 140 can be determined more precisely. [0045] The risk assessment workflow 100, in some implementations, includes a risk evaluation module 145. The risk evaluation module 145 can provide a risk profile report 150 identifying risks and associated vulnerabilities based upon the vulnerability assessment 140. The risk evaluation module 145 can include calculating a cyber risk score as a function of the threat profile (determined via the threat profiling module 120) and the vulnerability assessment 140. The cyber risk score, for example, may be assessed on a per threat and/or per security domain basis. The risk profile report 150 can provide a comprehensive review of all assessed cyber risks. The risk profile report 150 can include visualizations (e.g., graphs, charts, etc.) comparing the target evaluation to the current control evaluation, as well as visualizations regarding likely threats to various assets of the client technology infrastructure 110.).
It would have been obvious to a person in the ordinary skill in the art before the effective filing date of the claimed invention to combine Belfiore with the system of Narayan to determine risk value. One having ordinary skill in the art would have been motivated to use Belfiore into the system of Narayan for the purpose of cybersecurity risk assessment. (Belifore paragraph 15)
As per claim 20, it is similar to claim but also has this element the risk value influences a categorization of an alert for display.
Belfiore teaches the risk value influences a categorization of an alert for display ([0074] In some implementations, a vulnerability score is calculated for a given security domain (512). The vulnerability score may be calculated by determining a difference in score between the current control performance and the target score for a given security domain (and, if applicable, individual controls within the given security domain). For example, if the target score is higher than the current control performance for a given security domain, the current control performance may be vulnerable to a cyber-attack. Conversely, if the target score is lower than the current control performance for a given security domain, the current control performance may be receiving a greater allocation of cybersecurity protection budget than recommended. [0075] Step 512 of the method 500, in some implementations, is repeated for each additional security domain (514). Upon completing this evaluation, a vulnerability assessment, in some implementations, is generated (516). The information in the vulnerability assessment represents an aggregated score across each of the security domains as each vulnerability score relates to a specific level of preparedness within a particular cybersecurity domain in view of identified likely threats to the organization's IT infrastructure. The vulnerability assessment further represents a level of preparedness relative to business objectives of the organization, as described earlier in the development of the threat profile (e.g., the business objectives 112 and threat profile 125 described in relation to FIG. 1, or the business objectives identified in step 2 of the method 200 of FIG. 2 and as used in evaluating the criticality of protecting aspects of the IT infrastructure described in the overall method 200. The vulnerability assessment, for example, may be supplied for review (e.g., by the organization) and/or as a contributor to additional analysis. In a particular example, the vulnerability assessment may be provided to the risk evaluation module 145 for use in generating the risk profile report 150, as described in relation to FIG. 1 and [claim 15] automatically identifying, by the processing circuitry, one or more additional security controls for providing protection to the technological infrastructure against a portion of the one or more cybersecurity vulnerabilities; and presenting, via a remote computing system for review by a user affiliated with the entity, information regarding the one or more additional security controls. See Fig 5 Block 516 (Generate Vulnerability assessment) and Fig 7)
Claims 2, 12 are rejected under 35 U.S.C. 103 as being unpatentable over Narayan (US 2024/0039927 A1) in view of Belfiore (US 2018/0146004 A1) in further view of Wang (US 2011/0276490 A1).
As per claim 2, Narayan and Belfiore do not teach wherein the risk assessment component is configured to determine the risk value for a cloud resource of the plurality of cloud resources based, at least in part, on an age of the cloud resource.
However, Wang teaches wherein the risk assessment component is configured to determine the risk value for a cloud resource of the plurality of cloud resources based, at least in part, on an age of the cloud resource. (Wang [0075] If a user system 102 provides a put for an old version number, the cloud service provider 106 may inform the user system 102 of such conflict).
It would have been obvious to a person in the ordinary skill in the art before the effective filing date of the claimed invention to combine Wang with the system of Narayan and Belfiore to determine risk value based on the age of the resource. One having ordinary skill in the art would have been motivated to use Wang into the system of Narayan and Belfiore for the purpose of detecting the occurrence of security violations (Wang paragraph 07).
As per claim 12, Narayan teaches identifying a plurality of cloud resources within a cloud environment of a customer. wherein a cloud resource of the plurality of cloud resources corresponds to a logical element that performs a specific task or function within a cloud network ((Narayan Fig 4 Block 401 and Fig 5 and [0045] FIG. 4 is a flowchart of example operations for identifying attack chains across cloud resources. At block 401, an attack chain analyzer generates a graph structure for misconfigured cloud resources. Example operations for generating a graph structure for misconfigured cloud resources are described in detail with reference to FIG. 5. [0062] At block 505, the attack chain analyzer initializes nodes in a graph structure associated with each identified resource and corresponding metadata/attack chain stage. The attack chain analyzer can construct the graph structure such that nodes can be queried for resource metadata such as identifiers, vulnerabilities, policy misconfigurations with other resources, attack stages, etc. Each attack stage stored at a node for a resource corresponds to a stage of a malicious attack going towards the resource due to the corresponding policy misconfiguration or a stage of a vulnerability for that resource. Note that the attack stages for policy misconfigurations are associated with directed edges whereas attack stages for vulnerabilities are associated with the resources themselves. Resources can have multiple attack stages associated with multiple vulnerabilities and/or policy misconfigurations. The attack stage(s) for vulnerabilities can be stored as an ordered list in association with the resources)
collecting metadata associated with each of the plurality of cloud resources including a first cloud resource for storage within a storage subsystem, wherein the metadata associated with the first cloud resource includes (i) an age of the first cloud resource, (ii) a type of the first cloud resource (Narayan [0032] The attack chain diagnostics 135 can comprise additional information such as resource metadata (e.g., resource types, configurations, etc.), misconfiguration data (e.g., corresponding resources and severity metrics), exposure characteristics, etc. as well as fields indicated in the resource pair exposure characteristics 125 for remediation and vulnerabilities identified in the resource vulnerabilities 127. The attack chain analyzer 110 can further present the attack chain diagnostics 135 to a graphical user interface (not depicted) for inspection by an expert. The attack chain analyzer 110 collects attack chain diagnostics 135 for the identified attack chains and communicates them to a resource security manager 112 for remediation of any identified misconfiguration).
and (iii) information maintained within at least an impact tag submitted by the customer, wherein the impact tag is a customer-controlled metric to allow a risk value to be heightened by the customer based on a perceived importance of the first cloud resource in operability of the cloud environment; (Narayan [0021] A policy author 101 generates policies 103 for cloud resources that are stored in a cloud policy repository 100. The policies 103 correspond to configurations for cloud resources that are generated when cloud resources are initialized (e.g., by querying an application programming interface (API) for a cloud service provider (CSP)). In some instances, policies for cloud resources are automatically maintained by a CSP and, rather than being manually added by the policy author 101, the cloud policy repository 100 can query the CSP for cloud policies according to known resources in the cloud. Policies can be periodically updated to track changes) and [0023] The example cloud policy misconfiguration 111 represents a cloud policy that allows (as indicated by the “Effect”: “Allow” syntax) full access by a resource R3 (as indicated by the “Resource”: [“R3”]) to an Amazon Simple Storage Service (Amazon S3) resource (i.e., “R2”) corresponding to the policy. The example cloud policy misconfiguration 111 can be that the Amazon S3 resource R3 has overprivileged access to R2 and that R2 contains potentially sensitive data. Note that the “effect” and “action” fields are in bold to indicate that these fields are allowing overprivileged access by R3 to R2. This is for illustrative purposes, and cloud policy misconfiguration can have various formats when stored in memory. For instance, these fields along with the resource identifiers R3, R2 can be stored in memory, a standardized representation of these fields along with the resource identifiers can be stored in memory, a semantic description of the overprivileged access can be stored in memory, etc [0025] The cloud policy scan engine 104 communicates the cloud policy misconfigurations 123 to the incident management system 106 and the resource relationship engine 108. The incident management system 106 receives the cloud policy misconfigurations 123 and generates resource vulnerabilities 127. The incident management system 106 can analyze resources indicated in the cloud policy misconfigurations 123 to determine the resource vulnerabilities 127. The analyzed resources can include multiple resources indicated within each cloud policy misconfiguration corresponding to overprivileged access rights, open ports, known malware having vulnerability exploits for certain types of resources, etc. Certain resources can be flagged as having access to or containing sensitive data, whereas other resources can be flagged as having access to or containing publicly accessible data. Accordingly, the incident management system 106 can deem certain resource vulnerabilities as benign and can refrain from including these resources in the resource vulnerabilities 127 or can add them with a “benign vulnerability” label. In some embodiments, benign resource vulnerabilities can be tracked over time to determine whether security risk escalates due to increased resource exposure.).
Narayan does not teach determining an estimated risk value associated with the first cloud resource and other resources of the plurality of cloud resources forming a cloud architecture for display, wherein the risk value represents a potential risk of the cloud resource being subjected to a cyber threat or compromised by a cyberattack associated with the cyber threat or being used in compute a potential risk of the cloud architecture being subjected to the cyber threat or compromised by the cyberattack associated with the cyber threat.
However, Belifore teaches determining an estimated risk value associated with the first cloud resource and other resources of the plurality of cloud resources forming a cloud architecture for display, wherein the risk value represents a potential risk of the cloud resource being subjected to a cyber threat or compromised by a cyberattack associated with the cyber threat or being used in compute a potential risk of the cloud architecture being subjected to the cyber threat or compromised by the cyberattack associated with the cyber threat (Belfiore [0043] The cyber control evaluation module 130, in some implementations, analyzes the client IT infrastructure profile 135 to identify IT controls applied to a set of predetermined security domains 132. Additionally, the cyber control evaluation module 130 can determine a target control performance which can be based on the threat profile 125. The vulnerability assessment 140 can be determined as a function of comparing the target control performance against the current control performance for each relevant security domain 132. More specifically, the vulnerability assessment 140 can be calculated across each of the predetermined security domains as the predetermined security domains relate to a specific threat to a technology asset [resource] identified in the threat profile 125. Additionally, a threat-specific control environment can be defined based on the target control performance and the current control performance relating to controls specific to the threat scenarios identified in the threat profile 125 (including threat vectors). As a result of the threat specific control environment, the vulnerability assessment 140 can be determined more precisely. [0045] The risk assessment workflow 100, in some implementations, includes a risk evaluation module 145. The risk evaluation module 145 can provide a risk profile report 150 identifying risks and associated vulnerabilities based upon the vulnerability assessment 140. The risk evaluation module 145 can include calculating a cyber risk score as a function of the threat profile (determined via the threat profiling module 120) and the vulnerability assessment 140. The cyber risk score, for example, may be assessed on a per threat and/or per security domain basis. The risk profile report 150 can provide a comprehensive review of all assessed cyber risks. The risk profile report 150 can include visualizations (e.g., graphs, charts, etc.) comparing the target evaluation to the current control evaluation, as well as visualizations regarding likely threats to various assets of the client technology infrastructure 110.).
It would have been obvious to a person in the ordinary skill in the art before the effective filing date of the claimed invention to combine Belfiore with the system of Narayan to determine risk value. One having ordinary skill in the art would have been motivated to use Belfiore into the system of Narayan for the purpose of cybersecurity risk assessment. (Belifore paragraph 15)
Narayan and Belifore do not teach (i) an age of the first cloud resource.
However Wang teaches (i) an age of the first cloud resource. (Wang [0075] If a user system 102 provides a put for an old version number, the cloud service provider 106 may inform the user system 102 of such conflict).
It would have been obvious to a person in the ordinary skill in the art before the effective filing date of the claimed invention to combine Wang with the system of Narayan and Belfiore to determine risk value based on the age of the resource. One having ordinary skill in the art would have been motivated to use Wang into the system of Narayan and Belfiore for the purpose of detecting the occurrence of security violations (Wang paragraph 07).
Claims 14 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Narayan (US 2024/0039927 A1) in view of Belfiore (US 2018/0146004 A1) in further view of Wang (US 2011/0276490 A1) and Shenoy (US 2019/0098037 A1).
As per claim 14, Narayan and Belfiore and Wang do not teach determining risk value of the first cloud resource experiencing a misconfiguration based on the risk value determined for the first cloud resource and a baseline risk assigned when the misconfiguration is created.
However, Shenoy teaches determining risk value of the first cloud resource experiencing a misconfiguration based on the risk value determined for the first cloud resource and a baseline risk assigned when the misconfiguration is created. (Shenoy [0213] for example, the security system 450 may send an alert to a service provider or an organization associated with a user account associated with the flagged actions. Such an alert may detail that one or more actions associated with the user account did not violate a security rule, but the user account should be monitored. In another example, as a “light” resolution, if the amount of flagged actions are not met, then the security system 450 may elevate a base risk score associated with a user account. For example, a typical user account may have a base risk score of zero, but some user accounts may have a higher base risk score because they have previously taken one or more actions that have been flagged. The elevated base score may last an extended period of time (e.g., 1 month, 1 year, etc.))
It would have been obvious to a person in the ordinary skill in the art before the effective filing date of the claimed invention to combine Shenoy with the system of Narayan and Belfiore and Wang to use a baseline risk. One having ordinary skill in the art would have been motivated to use Shenoy into the system of Narayan and Belfiore and Wang for the purpose of providing real time threat analysis for multiple cloud-based services (Shenoy paragraph 06)
As per claim 19, Narayan and Belfiore and Wang do not teach determining a misconfiguration of the first cloud resource by at least evaluating properties associated with the first cloud resource by comparing the properties to one or more parameters associated with one or more known misconfigurations of a type corresponding to the first cloud resource to determine if the first cloud resource has been misconfigured.
However, Shenoy teaches determining a misconfiguration of the first cloud resource by at least evaluating properties associated with the first cloud resource by comparing the properties to one or more parameters associated with one or more known misconfigurations of a type corresponding to the first cloud resource to determine if the first cloud resource has been misconfigured. (Shenoy [0031] The security system may retrieve, from this or another memory, security rules associated with the first cloud-based service and/or an organization associated the first user account. The security rules may define security policies that user accounts associated with the organization must abide by. The security system may compare the flagged actions associated with the first user account to the security rules to determine when there are one or more security violations [0194] FIG. 6 is a diagram that illustrates an example security policies schema 600. The security policies the schema 600 may comprise a plurality of security rules. In some examples, the schema 600 may be stored in the security policies storage 406 of FIG. 4. The schema 600 may be queried by central controller 402 to determine if there are one or more security violations. In some examples, central controller 402 of may query the threat memory 404 to determine one or more flagged actions associated with a user account. The flagged actions may be determined with reference to schema 500 of FIG. 5. The central controller 402 of FIG. 4 may compare those flagged actions to one or more rules in the schema 600 of FIG. 6 to determine if a user associated with a user account has committed a security violation.)
It would have been obvious to a person in the ordinary skill in the art before the effective filing date of the claimed invention to combine Shenoy with the system of Narayan and Belfiore to compare properties or parameters to determine misconfiguration. One having ordinary skill in the art would have been motivated to use Shenoy into the system of Narayan and Belfiore for the purpose of providing real time threat analysis for multiple cloud-based services (Shenoy paragraph 06)
Claims 3-5 are rejected under 35 U.S.C. 103 as being unpatentable over Narayan (US 2024/0039927 A1) in view of Belfiore (US 2018/0146004 A1) in further view of Shenoy (US 2019/0098037 A1)
As per claim 3, Narayan and Belfiore do not teach wherein the risk assessment component is configured to determine the risk value for the cloud resource of the plurality of cloud resources based, at least in part, on a resource type of the cloud resource.
However, Shenoy teaches wherein the risk assessment component is configured to determine the risk value for the cloud resource of the plurality of cloud resources based, at least in part, on a resource type of the cloud resource. (Shenoy [0156] In various examples, a risk score can be computed as a weighted sum of the available indicators. For example, given indicators “I.sub.1, I.sub.2, . . . , I.sub.n” a risk score can be computed using the equation: and [0158] In some examples, the analytics engine 300 may obtain feedback on the validity and/or accuracy of a risk score. As an example, network administrators of an organization can provide feedback. As another example, adminsitrators of the security management and control system can provide feedback. Alternatively or additionally, in some examples, feedback can be obtained using autoamated machine learning algorithms, such as decision trees and neural networks. In some examples, the analytics engine 300 can adjust weights, indicators, and/or sources using the feedback, including possibly removing sources or indicators. In these and other examples, the threat detection engine 302 can compute a new risk score with the adjusted indicators and weights). [0165] In various implementations, the other analytics 306 can include detection of security controls drift, which can refer to the changing of one or more security controls in a seemingly arbitrary manner, which can increase security risks).
It would have been obvious to a person in the ordinary skill in the art before the effective filing date of the claimed invention to combine Shenoy with the system of Narayan and Belfiore to use type of resource to determine risk. One having ordinary skill in the art would have been motivated to use Shenoy into the system of Narayan and Belfiore for the purpose of providing real time threat analysis for multiple cloud-based services (Shenoy paragraph 06)
As per claim 4, Shenoy teaches wherein the risk assessment component is configured to determine the risk value for the cloud resource of the plurality of cloud resources based, at least in part, on an impact tag being a customer-controlled metric to allow the risk value to be heightened by the customer based on a perceived importance of the cloud resource in operability of the customer cloud environment. (Shenoy [0097] A user interface can be provided to show security controls for a organization's account with a cloud service and the assignment of security control values at a security level. As an example, security controls at a "stringent" level of security can include password requirements for a user account such as ten minimum characters, two numbers, one special character, one uppercase letter, no reuse of the last ten passwords, etc. [0156] In various examples, a risk score can be computed as a weighted sum of the available indicators. For example, given indicators “I.sub.1, I.sub.2, . . . , I.sub.n” a risk score can be computed using the equation: and [0158] In some examples, the analytics engine 300 may obtain feedback on the validity and/or accuracy of a risk score. As an example, network administrators of an organization can provide feedback. As another example, adminsitrators of the security management and control system can provide feedback. Alternatively or additionally, in some examples, feedback can be obtained using autamated machine learning algorithms, such as decision trees and neural networks. In some examples, the analytics engine 300 can adjust weights, indicators, and/or sources using the feedback, including possibly removing sources or indicators. In these and other examples, the threat detection engine 302 can compute a new risk score with the adjusted indicators and weights). [0165] In various implementations, the other analytics 306 can include detection of security controls drift, which can refer to the changing of one or more security controls in a seemingly arbitrary manner, which can increase security risks).
As per claim 5, Shenoy teaches wherein the risk assessment component is configured to determine an estimated risk value of a cloud resource experiencing a misconfiguration based on the risk value of the cloud resource and a baseline risk assigned when the misconfiguration is created. (Shenoy [0213] for example, the security system 450 may send an alert to a service provider or an organization associated with a user account associated with the flagged actions. Such an alert may detail that one or more actions associated with the user account did not violate a security rule, but the user account should be monitored. In another example, as a “light” resolution, if the amount of flagged actions are not met, then the security system 450 may elevate a base risk score associated with a user account. For example, a typical user account may have a base risk score of zero, but some user accounts may have a higher base risk score because they have previously taken one or more actions that have been flagged. The elevated base score may last an extended period of time (e.g., 1 month, 1 year, etc.))
Claims 6 is rejected under 35 U.S.C. 103 as being unpatentable over Narayan (US 2024/0039927 A1) in view of Belfiore (US 2018/0146004 A1) and Dzeparoska (US 2024/0193268 A1).
As per claim 6, Narayan and Belfiore do not teach wherein the risk assessment component is configured to determine the estimate risk value for a cloud architecture of the one or more cloud architectures based, at least in part, on a computation generated from risk values associated with each cloud resource of a subset of the plurality of cloud resources forming the cloud architecture and a computation generated from risk values associated with the subset of the plurality of cloud resources experiencing a misconfiguration.
However, Dzeparoska teaches wherein the risk assessment component is configured to determine the estimate risk value for a cloud architecture of the one or more cloud architectures based, at least in part, on a computation generated from risk values associated with each cloud resource of a subset of the plurality of cloud resources forming the cloud architecture and a computation generated from risk values associated with the subset of the plurality of cloud resources experiencing a misconfiguration. (Dzeparoska 0046] Network 190 facilitates wireless or wireline communications between the components of the environment 100 (e.g., between the counterweight calculation engine 102, the network monitor system 180, the access control engine 170, the risk score calculation engine 130, the threat evaluation engine 140, the endpoint 150, etc.), as well as with any other local or remote computers, such as additional mobile devices, clients, servers, or other devices communicably coupled to network 190, including those not illustrated in FIG. 1. In the illustrated environment, the network 190 is depicted as a single network, but can be comprised of more than one network without departing from the scope of this disclosure, so long as at least a portion of the network 190 can facilitate communications between senders and recipients. In some instances, one or more of the illustrated components (e.g., the counterweight calculation engine 102, the network monitor system 180, the access control engine 170, the risk score calculation engine 130, the threat evaluation engine 140, the endpoint 150, etc.) can be included within or deployed to network 190 or a portion thereof as one or more cloud-based services or operations)
It would have been obvious to a person in the ordinary skill in the art before the effective filing date of the claimed invention to combine Dzeparoska with the system of Narayan and Belfiore to calculate the risk of a subset of resources. One having ordinary skill in the art would have been motivated to use Dzeparoska into the system of Narayan and Belfiore for the purpose of detection and mitigation of alerts in networked environments.( Dzeparoska paragraph 1)
Claims 7 and 8 are rejected under 35 U.S.C. 103 as being unpatentable over Narayan (US 2024/0039927 A1) in view of Belfiore (US 2018/0146004 A1) in further view of Dzeparoska (US 2024/0193268 A1) and Skvortsov (US 2019/0053053 A1).
As per claim 7, Narayan and Belfiore and Dzeparoska do not teach wherein the computation generated from risk values associated with each cloud resource of the subset of the plurality of cloud resources forming the cloud architecture comprises a weighted average of the risk values associated with each cloud resource of the subset of the plurality of cloud resources forming the cloud architecture.
However, Skvortsov teaches wherein the computation generated from risk values associated with each cloud resource of the subset of the plurality of cloud resources forming the cloud architecture comprises a weighted average of the risk values associated with each cloud resource of the subset of the plurality of cloud resources forming the cloud architecture. (Skvortsov [0015] In one exemplary aspect, a method further comprises: determining that the user device is a threat risk based on the one or more generated clusters further comprises: determining that an average of a product of a first threat degree and an associated weight value and a product of a second threat and an associated weight value exceeds the threshold value)
It would have been obvious to a person in the ordinary skill in the art before the effective filing date of the claimed invention to combine Skvortsov with the system of Narayan and Belfiore and Dzeparoska to calculate a weighted average of risk. One having ordinary skill in the art would have been motivated to use Skvortsov into the system of Narayan and Belfiore and Dzeparoska for the purpose of identifying potentially dangerous devices during the interaction of a user with banking services (Dzeparoska paragraph 02)
As per claim 8, Skvortsov teaches wherein the computation generated from risk values associated with the subset of the plurality of cloud resources experiencing a misconfiguration comprises a weighted average of the risk values associated with the subset of the plurality of cloud resources experiencing the misconfiguration. (Skvortsov [0015] In one exemplary aspect, a method further comprises: determining that the user device is a threat risk based on the one or more generated clusters further comprises: determining that an average of a product of a first threat degree and an associated weight value and a product of a second threat and an associated weight value exceeds the threshold value)
Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over Narayan (US 2024/0039927 A1) in view of Belfiore (US 2018/0146004 A1) in further view of Reznik (US 12,189,779 B1)
As per claim 10, Narayan and Belfiore do not teach misconfiguration determination logic is further configured to evaluate whether the cloud resource is exposed to a public network in determining whether the cloud resource has been misconfigured.
However, Reznik teaches misconfiguration determination logic is further configured to evaluate whether the cloud resource is exposed to a public network in determining whether the cloud resource has been misconfigured (Reznik [col 7, lines 25-50] At S250, mismatches are compared with a vulnerability tool to determine whether the mismatch represents a cyber threat. Comparison of mismatches at S250 may include the analysis of one or more code portions via such a tool, including, without limitation, comparison of unique code determined, at S240, not to match the contents of one or more sources of code information, such as those described, where such mismatches may indicate code vulnerabilities. Comparison at S250 may include, without limitation, comparison of code, or hashes thereof, with data features, or hashes thereof, included in various external or internal code vulnerability databases, repositories, and the like, dependency analysis, such as determination of whether code portion, when executed, references a data feature external to a code package or library, where such a reference could include a vulnerability, code network analysis, such as determination of whether a given code portion, when executed, causes a vulnerability by action over a network, such as by connecting to the internet via an unsecured method, and the like, as well as any combination thereof. Comparison at S250 may further include labeling, tagging, or otherwise associating one or more data features with various code vulnerability status descriptors, and the like)
It would have been obvious to a person in the ordinary skill in the art before the effective filing date of the claimed invention to combine Reznik with the system of Narayan and Belfiore and Dzeparoska to determine exposure to a public network. One having ordinary skill in the art would have been motivated to use Reznik into the system of Narayan and Belfiore and Dzeparoska for the purpose of detection of cyber threats embedded in cloud applications.(Reznik col 1, lines 5-7)
Claim 11 is rejected under 35 U.S.C. 103 as being unpatentable over Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over Narayan (US 2024/0039927 A1) in view of Belfiore (US 2018/0146004 A1) in further view of Koottayi (US 2018/0288063 A1)
As per claim 11, Narayan and Belfiore do not teach an output subsystem configured to generate a plurality of alerts and prioritize the plurality of alerts based on the risk value of the cloud architecture with which each alert is associated, wherein the plurality of alerts are categorized into at least (i) a critical alert associated with a cloud resource or cloud architecture having a highest risk level, (ii) a suspicious alert associated with a lower risk level than the critical alert, and (iii) a misconfiguration alert associated with a misconfiguration of a cloud resource of the plurality of cloud resources or a cloud architecture of the one or more cloud architectures.
However, Koottayi teaches an output subsystem configured to generate a plurality of alerts and prioritize the plurality of alerts based on the risk value of the cloud architecture with which each alert is associated, wherein the plurality of alerts are categorized into at least (i) a critical alert associated with a cloud resource or cloud architecture having a highest risk level, (ii) a suspicious alert associated with a lower risk level than the critical alert, and (iii) a misconfiguration alert associated with a misconfiguration of a cloud resource of the plurality of cloud resources or a cloud architecture of the one or more cloud architectures. (Koottayi [0132] The threat alert 730 and the threat summary widgets 735 show a summary of all the low 745, medium 750, and high 755 threats occurring with respect to the target system. Accordingly, when the users 720 are accessing the target system, the threat detection component shows an administrator who are all the users 720, all the threats 710 associated with them, and the applications or resources being accessed by the users 720.).
It would have been obvious to a person in the ordinary skill in the art before the effective filing date of the claimed invention to combine Koottayi with the system of Narayan and Belfiore to use different levels of alert. One having ordinary skill in the art would have been motivated to use Koottayi into the system of Narayan and Belfiore for the purpose of threat detection and managing user access to resources in an enterprise environment. (Koottayi paragraph 02)
Claim 15 is rejected under 35 U.S.C. 103 as being unpatentable over Narayan (US 2024/0039927 A1) in view of Belfiore (US 2018/0146004 A1) in further view of Wang (US 2011/0276490 A1) and Dzeparoska (US 2024/0193268 A1).
As per claim 15, Narayan and Belfiore and Wang do not teach determining a risk value associated with the cloud architecture based, at least in part, on a computation generated from risk values associated with each cloud resource of a subset of the plurality of cloud resources forming the cloud architecture and a computation generated from risk values associated with the subset of the plurality of cloud resources experiencing a misconfiguration.
However, Dzeparoska teaches determining a risk value associated with the cloud architecture based, at least in part, on a computation generated from risk values associated with each cloud resource of a subset of the plurality of cloud resources forming the cloud architecture and a computation generated from risk values associated with the subset of the plurality of cloud resources experiencing a misconfiguration. (Dzeparoska 0046] Network 190 facilitates wireless or wireline communications between the components of the environment 100 (e.g., between the counterweight calculation engine 102, the network monitor system 180, the access control engine 170, the risk score calculation engine 130, the threat evaluation engine 140, the endpoint 150, etc.), as well as with any other local or remote computers, such as additional mobile devices, clients, servers, or other devices communicably coupled to network 190, including those not illustrated in FIG. 1. In the illustrated environment, the network 190 is depicted as a single network, but can be comprised of more than one network without departing from the scope of this disclosure, so long as at least a portion of the network 190 can facilitate communications between senders and recipients. In some instances, one or more of the illustrated components (e.g., the counterweight calculation engine 102, the network monitor system 180, the access control engine 170, the risk score calculation engine 130, the threat evaluation engine 140, the endpoint 150, etc.) can be included within or deployed to network 190 or a portion thereof as one or more cloud-based services or operations)
It would have been obvious to a person in the ordinary skill in the art before the effective filing date of the claimed invention to combine Dzeparoska with the system of Narayan and Belfiore and Wang to calculate the risk of a subset of resources. One having ordinary skill in the art would have been motivated to use Dzeparoska into the system of Narayan and Belfiore and Wang for the purpose of detection and mitigation of alerts in networked environments.( Dzeparoska paragraph 1)
Claim 16, 17 are rejected under 35 U.S.C. 103 as being unpatentable over Narayan (US 2024/0039927 A1) in view of Belfiore (US 2018/0146004 A1) in further view of Wang (US 2011/0276490 A1) and Dzeparoska (US 2024/0193268 A1) and Skvortsov (US 2019/0053053 A1).
As per claim 16, Narayan and Belfiore and Wang and Dzeparoska do no teach wherein the computation generated from risk values associated with each cloud resource of the subset of the plurality of cloud resources forming the cloud architecture comprises a weighted average of the risk values associated with each cloud resource of the subset of the plurality of cloud resources forming the cloud architecture.
However, Skvortsov teaches wherein the computation generated from risk values associated with each cloud resource of the subset of the plurality of cloud resources forming the cloud architecture comprises a weighted average of the risk values associated with each cloud resource of the subset of the plurality of cloud resources forming the cloud architecture. (Skvortsov [0015] In one exemplary aspect, a method further comprises: determining that the user device is a threat risk based on the one or more generated clusters further comprises: determining that an average of a product of a first threat degree and an associated weight value and a product of a second threat and an associated weight value exceeds the threshold value)
It would have been obvious to a person in the ordinary skill in the art before the effective filing date of the claimed invention to combine Skvortsov with the system of Narayan and Belfiore and Wang and Dzeparoska to calculate a weighted average of risk. One having ordinary skill in the art would have been motivated to use Skvortsov into the system of Narayan and Belfiore and Wang and Dzeparoska for the purpose of identifying potentially dangerous devices during the interaction of a user with banking services (Dzeparoska paragraph 02)
As per claim 17, Skvortsov teaches wherein the computation generated from risk values associated with the subset of the plurality of cloud resources experiencing a misconfiguration comprises a weighted average of the risk values associated with the subset of the plurality of cloud resources experiencing the misconfiguration. (Skvortsov [0015] In one exemplary aspect, a method further comprises: determining that the user device is a threat risk based on the one or more generated clusters further comprises: determining that an average of a product of a first threat degree and an associated weight value and a product of a second threat and an associated weight value exceeds the threshold value)
Allowable Subject Matter
Claims 9, 13 and 18 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Response to Arguments
Applicant's arguments filed on 07/20/2026 have been fully considered but they are not persuasive.
Applicant’s arguments with respect to claims 1, 12 and 20 have been considered but are moot because the arguments do not apply because of the introduction of new art by Narayan and Belifore.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MEHRAN KAMRAN whose telephone number is (571)272-3401. The examiner can normally be reached on 9-5.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor April Blair, can be reached on (571)270-1014. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MEHRAN KAMRAN/Primary Examiner, Art Unit 2196
