84362821The present application, filed on or after 16 March 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This office action is in response to Applicant’s submission filed on 8 February 2024. THIS ACTION IS NON-FINAL.
Status of Claims
Claims 1-20 are pending.
Claims 7-8, 9-20 are rejected under 35 U.S.C. 112(b) as indefinite.
Claim 1-20 are rejected under 35 U.S.C. 101 for being directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
Claims 2, 10, 15 and 17 are objected to.
There is no art rejection for claims 1-20.
Claim Objections
Claim 2 / 10 / 17 is objected to because of the following informalities: it’s parent claim recites "applying an intrusion detection model to the processed traffic data" (first introduction of the model, implying it already exists in trained form at the time of application). The claim then recites, as a "further comprising" limitation, "generating, using a neural network architecture and the training dataset, the intrusion detection model" — i.e., an act of creating the same model that claim 1 already applies. Because the claim does not specify that the generating step occurs prior to the applying step of the parent claim, and because "further comprising" ordinarily does not impose a sequence, the combined claim is susceptible to an interpretation in which the model is applied before it is generated. While a logical/temporal order can reasonably be inferred by a POSITA, the Office notes this as a drafting clarity issue that could be resolved by adding sequential language (e.g., "wherein the intrusion detection model is generated prior to the applying"). Appropriate correction is required.
Claim 15 is objected to to because of the following informalities: the claim recites "generating documentation" and subsequently refers to "the document generation process." "Process" is not separately introduced as a claim term; while reasonably understood as referring back to the "generating documentation" step, strict antecedent-basis practice would use consistent terminology (e.g., "wherein generating the documentation comprises..."). Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
A claim is indefinite if, when read in light of the specification, it fails to inform, with reasonable certainty, those skilled in the art about the scope of the invention. Nautilus, Inc. v. Biosig Instruments, Inc., 110 USPQ.2d 1688, U.S. Supreme Court (2014).
Claims 7-8, 9-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Regarding claim 9, the claim recites a non-transitory computer readable medium comprising program code which, when executed, "enable[s] the computer processor to perform a method for managing remote memory." However, the body of claim 9 recites no limitation directed to memory management of any kind — it recites only intrusion-detection functionality (monitoring network traffic, processing traffic data, applying an intrusion detection model, detecting an anomaly, and implementing a data privacy protection policy). The term "remote memory" has no antecedent basis, no corresponding structure, and no apparent connection to any recited step. It is unclear whether claim 9 is directed to memory management, intrusion detection, or some claim of both, and the metes and bounds of the claim cannot be determined as written, the claim is therefore indefinite. Appropriate correction: amend "a method for managing remote memory" to "a method for managing intrusion detection" (consistent with claim 1's preamble).
Regarding claim 16, the claim is rejected as indefinite for the identical reason. The preamble recites "A system for managing remote memory, comprising: a processor; and memory comprising instructions, which when executed by the processor, perform a method comprising" intrusion-detection steps identical in substance to claim 1. As with claim 9, "remote memory" has no antecedent basis and no discernible relationship to the recited intrusion-detection functionality, rendering the scope of the claim indeterminate, the claim is therefore indefinite.
Regarding claims 9-15 / 17-20, which depend on above rejected claim 9 / 16, are rejected for the same reason.
Regarding claims 7 / 8 / 14 / 15 / 20, the claim recites the transitional phrase "after remediating the anomaly." However, no antecedent step of "remediating the anomaly" is recited in the parent claims (1, 9, or 16). The parent claims recite only "implementing a data privacy protection policy to remediate the anomaly" — i.e., an act performed with the purpose or intent of remediation, not a recitation that remediation is confirmed to have occurred. It is therefore unclear what event triggers the subsequent step(s): (i) completion of the "implementing" act itself, regardless of outcome, or (ii) some further, unclaimed determination that the anomaly has in fact been remediated. The metes and bounds of "after remediating the anomaly" cannot be determined as written, the claim is therefore indefinite. Appropriate correction: amend to "after implementing the data privacy protection policy" (or similar language tracking the actual antecedent step), unless a distinct "remediating" step is separately claimed.
Regarding claim 7 / 14 / 20, the claim recite "based on...the implementing." The parent claims recite the step "implementing a data privacy protection policy to remediate the anomaly" using "implementing" only as a gerund verb phrase, never introduced as a noun element (e.g., "an implementing step" or "the implementation"). Accordingly, "the implementing" as a standalone noun phrase lacks clear antecedent basis, the claim is therefore indefinite.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Judicial Exception
Claims 1-20 of the claimed invention are directed to a judicial exception, an abstract idea, without significantly more.
Regarding claims 1-20,
(Independent Claims) With regards to claim 1 / 9 / 16,
Step 1: The claim recites a process / article of manufacturing / machine, which falls into one of the statutory categories.
Step 2A – Prong 1: the claim, in part, recites:
(a)“… monitoring…network traffic between a plurality of devices in a system to obtain raw traffic data, wherein the raw traffic data comprises data packets sent from one of the plurality of devices to another of the plurality of devices…” (mental process and/or math concept), as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, other than reciting generic computer elements, nothing in the claim element precludes the step from practically being performed in the mind. For example, but for the language about generic computer elements, “monitoring …”, in the limitation citied above encompasses observing network traffic activity, which is based on observation, evaluation, judgement, and/or opinion, that could be performed by human using paper / pen / calculator. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas.
(b) “… processing the raw traffic data to obtain processed traffic data; applying an intrusion detection model to the processed traffic data; making a determination, based on the applying, that an anomaly is detected in the processed traffic data…” (mental process and/or math concept), as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, other than reciting generic computer elements, nothing in the claim element precludes the step from practically being performed in the mind. For example, but for the language about generic computer elements, “processing …”, “applying …”, “making a determination …”in the limitation citied above encompasses evaluating / processing traffic data using a model to make decision, which is based on observation, evaluation, judgement, and/or opinion, that could be performed by human using paper / pen / calculator. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas.
(c) “…. based on the determination, implementing a data privacy protection policy to remediate the anomaly…” (mental process and/or method of organizing human activity), as drafted, is a process that, under its broadest reasonable interpretation, covers certain methods of organizing human activity.
Accordingly, the claim recites an abstract idea.
Step 2A – Prong 2: This judicial exception is not integrated into a practical application. In particular, the claim recites the additional elements of: “A non-transitory computer readable medium comprising computer readable program code, which when executed by a computer processor enables the computer processor to perform a method for managing remote memory …”, “A system for managing remote memory, comprising: a processor; and memory comprising instructions, which when executed by the processor, perform a method … “, “neural network intrusion detection system (NNIDS)…”, which is mere instructions to implement an abstract idea using generic computing device, or merely uses a computer as a tool to perform an abstract idea (see MPEP 2106.05(f)). Accordingly. the additional elements individually or in combination do not integrate the judicial exception into a practical application. The claim is directed to an abstract idea.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above, the claim recites the additional elements of “A non-transitory computer readable medium comprising computer readable program code, which when executed by a computer processor enables the computer processor to perform a method for managing remote memory …”, “A system for managing remote memory, comprising: a processor; and memory comprising instructions, which when executed by the processor, perform a method … “, “neural network intrusion detection system (NNIDS)…”, which is mere instructions to implement an abstract idea using generic computing device, or merely uses a computer as a tool to perform an abstract idea (see MPEP 2106.05(f)). Accordingly, the additional elements individually or in combination do not amount to significantly more than the judicial exception. The claim is not patent eligible.
(Dependent claims)
Claims 2-8 / 10-15 / 17-20 are dependent on claim 1 / 9 / 16 and include all the limitations of claim 1 / 9 / 16. Therefore, claims 2-8 / 10-15 / 17-20 recite the same abstract ideas.
With regards to claim 2 / 10 / 17, the claim recites further limitation of “… processing the second raw traffic data to generate a training dataset; and generating …. using the training dataset, the intrusion detection model” (mental process and/or math concept), which is further process of traffic data analysis, which is based on observation, evaluation, judgement, and/or opinion, that could be performed by human using paper / pen / calculator. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas.
The claim recites additional element of “collecting, by the NNIDS, second raw traffic data”, which is extra-solution activity of pre-solution data gathering / post-solution data output (see MPEP.2106.05(g)). Accordingly, at Step 2A, prong two, the additional elements individually or in combination do not integrate the judicial exception into a practical application. The claim is directed to an abstract idea.
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above, the additional element of “collecting, by the NNIDS, second raw traffic data”, which is extra-solution activity of pre-solution data gathering / post-solution data output (see MPEP.2106.05(g)). The courts have found limitations directed to obtaining information electronically, recited at a high level of generality, to be well-understood, routine, and conventional (see MPEP 2106.05(d)(II), “receiving or transmitting data over a network”, "electronic record keeping," and "storing and retrieving information in memory"). Accordingly, at Step 2B the additional elements individually or in combination do not amount to significantly more than the judicial exception.
The claim is not patent eligible.
With regards to claim 3 / 11, the claim recites further limitation of “… wherein processing the raw traffic data comprises removing noise and normalizing features for the intrusion detection model, wherein removing the noise comprises filtering the data packets to include relevant information, and wherein normalizing the features comprises standardizing metadata included in the data packets” (mental process and/or math concept), which is further process of traffic data analysis, which is based on observation, evaluation, judgement, and/or opinion, that could be performed by human using paper / pen / calculator. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Except citing generic computer elements to implement the abstract idea, there is no additional element showing integration into a practical application or adding something significantly more to the abstract idea. The claim is not patent eligible.
With regards to claim 4 / 12 / 18, the claim recites further limitation of “… wherein the data privacy protection policy comprises a mapping between the anomaly and a remediation action for remediating the anomaly” (mental process and/or organizing human activity), which is further process of traffic data analysis, which is based on observation, evaluation, judgement, and/or opinion, that could be performed by human using paper / pen / calculator. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Except citing generic computer elements to implement the abstract idea, there is no additional element showing integration into a practical application or adding something significantly more to the abstract idea. The claim is not patent eligible.
With regards to claim 5 / 13 / 19, the claim recites further limitation of “… wherein the remediation action comprises notifying an administrator of the anomaly” (mental process and/or organizing human activity), which is certain methods of organizing human activity. Except citing generic computer elements to implement the abstract idea, there is no additional element showing integration into a practical application or adding something significantly more to the abstract idea. The claim is not patent eligible.
With regards to claim 6, the claim recites further limitation of “… wherein the remediation action comprises flagging a source device sending network traffic associated with the anomaly.” (mental process and/or math concept), which is further process of traffic data analysis, which is based on observation, evaluation, judgement, and/or opinion, that could be performed by human using paper / pen / calculator. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Except citing generic computer elements to implement the abstract idea, there is no additional element showing integration into a practical application or adding something significantly more to the abstract idea. The claim is not patent eligible.
With regards to claim 7 / 14, The claim recites additional element of “… after remediating the anomaly, performing a retraining of the intrusion detection model based on the determination and based on the implementing” which is mere instructions to implement an abstract idea using generic computing device, or merely uses a computer as a tool to perform an abstract idea (see MPEP 2106.05(f)). Accordingly, at Step 2A, prong two, the additional elements individually or in combination do not integrate the judicial exception into a practical application. The claim is directed to an abstract idea.
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above, the additional element of “… after remediating the anomaly, performing a retraining of the intrusion detection model based on the determination and based on the implementing” which is mere instructions to implement an abstract idea using generic computing device, or merely uses a computer as a tool to perform an abstract idea (see MPEP 2106.05(f)). Accordingly, at Step 2B the additional elements individually or in combination do not amount to significantly more than the judicial exception.
The claim is not patent eligible.
With regards to claim 8 / 15 / 20, the claim recites further limitation of “… after remediating the anomaly, generating documentation based on the implementation of the data privacy protection policy and based on the anomaly” (mental process and/or math concept), which is further process of traffic data analysis, which is based on observation, evaluation, judgement, and/or opinion, that could be performed by human using paper / pen / calculator. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Except citing generic computer elements to implement the abstract idea, there is no additional element showing integration into a practical application or adding something significantly more to the abstract idea. The claim is not patent eligible.
Allowable Subject Matter
Claims 1-20 include allowable subject matter since when reading the claims in light of the specification, as per, MPEP §2111.01 or Toro Co. v. White Consolidated Industries Inc., 199F.3d 1295, 1301, 53 USPQ2d 1065, 1069, 1069 (Fed.Cir. 1999), none of the references of record alone or in combination disclose or suggest the combination of limitations specified in claims 1-20.
In interpreting the claims, in light of the specification filed on 8 February 2024, the Examiner finds the claimed invention to be patentably distinct from the prior arts of record.
Regarding the independent claims, the primary reason for the allowance is the inclusion of the specific process of applying a neural network intrusion detection model to processed network traffic data and, based on detecting an anomaly, implementing a data privacy protection policy to remediate the anomaly.
None of the cited prior art references, singly or in combination, fully teaches all limitations of independent claims 1, 9 and 16.
Regarding the dependent claims, which include all the limitations of the independent claims, are also allowed.
The followings are references close to the invention claimed:
Vasseur et al., US-PGPUB No. 20160219070A1 [hereafter Vasseur] teaches distributed learning agents monitoring network traffic flows, applying machine learning models to detect anomalies, and performing local mitigation actions. However, Vasseur does not teach implementing a data privacy protection policy to remediate the detected anomaly.
Brigandi et al., US-PGPUB No. 20190354690A1 [hereafter Brigandi] teaches detecting, reporting, and remediating data privacy-related compliance violations by generating actionable mitigation and remediation recommendations at the application level. However, Brigandi does not teach applying a neural network intrusion detection model to processed network traffic data between devices.
Vasu et al., US-PGPUB No. 20220014554A1 [hereafter Vasu] teaches intercepting network traffic inputs, synthesizing images via a generative adversarial network, and classifying anomaly signatures using a convolutional neural network. However, Vasu does not teach implementing a data privacy protection policy or retraining the intrusion detection model based on the remediation outcome.
Al-Turaiki et al., "A Convolutional Neural Network for Improved Anomaly-Based Network Intrusion Detection," Big Data, vol. 9, no. 3, pp. 233-252, 2021 [hereafter Al-Turaiki] teaches a two-step preprocessing approach combined with a convolutional neural network for classifying network intrusion attacks. However, Al-Turaiki does not teach implementing a data privacy protection policy responsive to a detected anomaly.
Tran et al., "Novel Intrusion Detection using Probabilistic Neural Network and Adaptive Boosting," arXiv:0911.0485, November 3, 2009 [hereafter Tran] teaches a boosted probabilistic neural network detecting malicious network activity and informing authorities to take corrective action. However, Tran does not teach processing raw traffic data into processed traffic data or a data privacy protection policy.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TSU-CHANG LEE whose telephone number is 571-272-3567. The fax number is 571-273-3567.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Omar Fernandez Rivas, can be reached 571-272-2589.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/TSU-CHANG LEE/
Primary Examiner, Art Unit 2128
