Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments filed 12/29/2025 have been fully considered.
Applicant argues the prior art fails to teach or suggest parsing network traffic data to identify header information associated with the network traffic data at different network layers according to open systems interconnection (OSI) model.
Applicant’s arguments are not persuasive as Kapoor discloses a system to parse network traffic to identify information associated with the network traffic at different network layers of the OSI model. For example, Kapoor discloses network elements which parse network traffic at various levels of the OSI model (¶ 561-562, parsing of network traffic at different network layers according to the OSI model) where the parsing is directed at the header of the packet (Kapoor, ¶ 24).
Applicant argues the prior art fails to teach or suggest clustering the network traffic data into baseline network traffic data based on the header information associated with the network traffic at a particular network layer of the different network layers. Applicant’s arguments are not persuasive as Kapoor discloses the clustering of traffic to identify baseline/normal traffic based on specific parameters in e.g. ¶ 17-18, 27, 35-39, 57, 65-68, 71-72, 130-132, 514-523).
Applicant’s further arguments are not persuasive as they amount to a general allegation that the claims define a patentable invention without specifically pointing out how the language of the claims patentably distinguishes them from the references.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(B) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claim(s) 1-20 are rejected under 35 U.S.C. 112, second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which applicant regards as the invention.
Claim 1 recites the limitation "the network traffic data into baseline network traffic data based on the header information associated with the network traffic at a particular network layer of the different network layers”. There is insufficient antecedent basis for this limitation in the claim. Claims 11 and 16 are addressed by similar rationale. Dependent claims not addressed are rejected for incorporating the deficiencies of their respective parent claims.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claim 1-6, 8-9, 11-20 are rejected under 35 U.S.C. 103 as being unpatentable over US 20160366160 to Kapoor in view of US 20040205356 to Maida-Smith.
.
Regarding claim 1, Kapoor teaches a system for identifying one or more anomalous network sessions in a network environment comprising:
a memory comprising a first data, wherein the first data store is operable to store network traffic data (¶ 145, database server, ¶ 212. logging database); and a processor, operably coupled with the memory, and configured to: collect the network traffic data based at least in part on a plurality of network sessions between a source and a destination in the network environment (¶ 126, 157, 17-18, 24, 27, 35-39, 67-68, collection data based on sessions between source and destination;
parse the network traffic data to identify header information associated with the network traffic data at different network layers according to open systems interconnection (OSI) model (¶ 57, 65-68, 71-72, 130-132, 223-228, 455, 514-519, 561-562, parsing data to identify parameters of traffic at different network layers according to the OSI model);
cluster the network traffic data into baseline network traffic data based on the header information associated with the network traffic at a particular network layer of the different network layers (¶ 17-18, 27, 35-39, 57, 65-68, 71-72, 130-132, 514-523, clustering traffic to identify baseline/normal traffic based on specific parameters);
identify unknown network traffic based at least in part upon the clustered network traffic data (¶ 17-18, 27, 35-39, 57, 65-68, 71-72, 130-132, 514-523, identification of unknow traffic);
analyze the unknown network traffic with respect to the baseline network traffic data to identify the one or more anomalous network sessions in the plurality of network sessions (¶ 17-18, 26-28, 35-39, 57-59, 65-68, 71-72, 130-132, 514-523, analysis to identify anomalous session; see also 223-228, 455);
determine one or more mitigation actions for the identified one or more anomalous network sessions; and perform the one or more mitigation actions for the identified one or more anomalous network sessions, wherein the one or more mitigation actions are performed for the identified one or more anomalous network sessions without disrupting other network sessions in the plurality of network sessions (¶ 26-27, 34-39, 45-50, 59, 67-68, 455, 519-523, determine and perform migration actions).
Kapoor fails to teach but Maida-Smith teaches: a second data store operable to store clustered network traffic data (¶ 26).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Maida-Smith. The motivation to do so is that the teachings of Maida-Smith would have been advantageous in terms of facilitating the management of network security data (Maida-Smith, ¶ 8, 26).
Regarding claim 2, 12, 17,
Kapoor teaches:
obtain metadata from the collected network traffic data (¶ 205, 236, 17-18, 26-27);
wherein the parsing, the clustering, and the analyzing the unknown network traffic are performed based at least in part upon the metadata obtained from the collected network data (¶ 205, 236, 17-18, 26-27, 43-44, 46-50, 67-68, parse, cluster, and analyze based in part on metadata).
Regarding claim 3, 13, 18,
Kapoor teaches:
store the parsed network traffic data and identified parameters associated with the network traffic data in the first data store; retrieve the parsed network traffic data and the identified parameters associated with the network traffic data at the different network layers from the first data store; and extract a subset of network traffic data from the collected network traffic data using the retrieved data from the first data store, wherein: the extracted subset of network traffic data is associated with the one or more specific parameters of the plurality of parameters at the one or more network layers; the extracted subset of network traffic data is used to identify the one or more anomalous network sessions; and the clustering is performed based on the extracted subset of network traffic data (¶ 17-18, 26-28, 35-39, 57-59, 65-68, 71-72, 130-132, 514-523, analysis to identify anomalous session; see also 223-228, 455; storing, retrieving, extracting subset to identify particular parameters of network layers, identification and clustering).
Regarding claim 4, 14, 19,
Kapoor teaches:
wherein the clustering the network traffic data comprises: comparing the subset of network traffic data against one or more predetermined thresholds; and generating a cluster of the baseline network traffic data and the unknown network traffic based on the comparison (¶ 46-50, 176-178, 432-437, 584, baseline/normal traffic determined/gathered/clustered based on threshold comparison).
Regarding claim 5, 15, 20,
Kapoor teaches:
wherein the one or more mitigation actions for the identified one or more anomalous network sessions comprise: terminating the one or more anomalous network sessions; slowing down network traffic across the one or more anomalous network sessions; re-routing the one or more anomalous network sessions to a particular location; restarting one or more network sessions affected by the one or more anomalous network sessions; requesting users associated with the one or more anomalous network sessions to re-authenticate; locking user accounts of the users associated with the one or more anomalous network sessions; or adding network characteristics and the users associated with the one or more anomalous network sessions to a disapproved list (¶ 26, 34, 59, 67-68, 455, 51-529, mitigation actions).
Regarding claim 6,
Kapoor teaches:
wherein one or more of the parsing, the clustering, or the analyzing the unknown network traffic is performed using machine learning or artificial intelligence techniques (¶ 18, 26, 42-45).
Regarding claim 8,
Kapoor teaches:
store the clustered network traffic data in a data store; retrieve the clustered network traffic data from a data store; and perform cluster analysis using the clustered network traffic data retrieved from a data store; wherein the cluster analysis comprises analyzing the unknown network traffic with respect to the baseline network traffic data to determine whether or not the unknown network traffic is anomalous and identifying the one or more anomalous network sessions in the plurality of network sessions responsive to determining that the unknown network traffic is anomalous (¶ 17-18, 26-28, 35-39, 57-59, 65-68, 71-72, 130-132, 223-228, 455, 514-523, analysis to identify anomalous session; see also 223-228, 455; storing, retrieving, and analyzing clustered network traffic data comprising analysis with respect to baseline/normal traffic to identify anomalous data).
Kapoor fails to teach wherein the data store is the second data store. However, Maida-Smith discloses the second data store (¶ 26). Motivation to include Maida-Smith is the same as presented above.
Regarding claim 9,
Kapoor teaches:
wherein the source comprises one or more endpoint devices (fig. 1-2, ¶ 14-21, endpoint devices); and the destination comprises one or more network demilitarized zones (DMZs) (¶ 28-31, firewall protected zone).
Claim 11 and 16 are addressed by similar rationale as claim 1.
Claim 7 is rejected under 35 U.S.C. 103 as being unpatentable over Kapoor and Maida-Smith in view of US 20090254971 to Herz.
Regarding claim 7,
Kapoor fails to teach but Herz teaches:
wherein the clustering is performed using one or more of: K-means clustering; or Calinski-Harabasz criterion clustering (¶ 614-617).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Herz. The motivation to do so is that the teachings of Herz would have been advantageous in terms of facilitating cluster groupings and partitioning cluster space (Herz, ¶ 614-617).
Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over Kapoor and Maida-Smith in view of US 20160054865 to Kerr.
Regarding claim 10,
Kapoor teaches:
wherein the destination comprises one or more network demilitarized zones (DMZs) (¶ 28-31, firewall protected zone).
Kapoor fails to teach but Kerr teaches:
wherein the source comprises one or more cloud service providers (¶ 81, 94, 139, fig. 1, fig. 3).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Kerr. The motivation to do so is that cloud service providers are a common and useful source of data transmissions.
CONCLUSION
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RYAN J JAKOVAC whose telephone number is (571)270-5003. The examiner can normally be reached on 8-4 PM EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Oscar A. Louie can be reached on 572-270-1684. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/RYAN J JAKOVAC/Primary Examiner, Art Unit 2445