DETAILED ACTION
This communication is in response to the application filed 10/30/23 in which claims 1-13 were presented for examination and the preliminary amendment filed 11/16/23 in which claims 1-7 and 11-13 were amended. Claims 1-13 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 4/8/24 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or non-obviousness.
Claims 1-2, 7-9, 11, and 13 are rejected under 35 U.S.C. 103 as being unpatentable over Ferreira, Artur J., and Mário AT Figueiredo. "Boosting algorithms: A review of methods, theory, and applications." Ensemble machine learning (2012): 35-85 (“Ferreira”) in view of Hu, Weiming, Wei Hu, and Steve Maybank. "Adaboost-based algorithm for network intrusion detection." IEEE Transactions on Systems, Man, and Cybernetics, Part B (Cybernetics) 38.2 (2008): 577-583 (“Hu”), and Denchev (US 11,620,573 B1; published Apr. 4, 2023).
Regarding claim 1, Ferreira discloses [a] method including the following steps:
adjusting weight values of a boosted classifier, the boosted classifier being a classifier…(Ferreira Section 3.3 page 9:
[AltContent: oval]
PNG
media_image1.png
500
864
media_image1.png
Greyscale
(The respective weights of the constituent weak learners are interpreted as the claimed weight values of the boosted classifier. During each iteration these weights are computed for each weak learner.))
the boosted classifier comprising the weight values and a plurality of classifiers, each classifier of the plurality of classifiers being associated with a weight value of the weight values; (Ferreira pg. 9:
[AltContent: oval]
PNG
media_image1.png
500
864
media_image1.png
Greyscale
(The final classifier is the boosted classifier and comprises the combination of the weak classifiers weighted by the computed weight values.)).
Ferreira does not expressly disclose that the boosted classifier is utilized for calculating whether data is indicative of an intrusion into a computing entity (but see Hu Abstract (“—Network intrusion detection aims at distinguishing the attacks on the Internet from normal use of the Internet. It is an indispensable part of the information security system. Due to the variety of network behaviors and the rapid development of attack fashions, it is necessary to develop fast machine-learning-based intrusion detection algorithms with high detection rates and low false-alarm rates. In this correspondence, we propose an intrusion detection algorithm based on the AdaBoost algorithm. In the algorithm, decision stumps are used as weak classifiers. The decision rules are provided for both categorical and continuous features. By combining the weak classifiers for continuous features and the weak classifiers for categorical features into a strong classifier, the relations between these two different types of features are handled naturally, without any forced conversions between continuous and categorical features. Adaptable initial weights and a simple strategy for avoiding overfitting are adopted to improve the performance of the algorithm. Experimental results show that our algorithm has low computational complexity and error rates, as compared with algorithms of higher computational complexity, as tested on the benchmark sample data.”)).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Ferreira to incorporate the teachings of Hu to develop an intrusion detection algorithm based on the AdaBoost algorithm, at least because doing so would enable high detection rates and low false-alarm rates.
Ferreira does not expressly disclose the step of adjusting the weight values comprising adjusting, by at least one quantum computing device, states of qubits for reducing a value of a cost function of the boosted classifier; wherein the adjusted weight values are based on the adjusted states of qubits (but see Denchev 3:37-51 (“FIG. 1 is an illustration of an example system for determining a linear combination of active weak classifiers. The system includes a computing resource 120 that can include one or more classical computers, one or more software computing units executing in virtual machines on one or more computers, and is configured to execute a totally corrective boosting with cardinality penalization process. In some implementations the computing resource can include quantum optimization hardware, e.g., adiabatic quantum hardware that can implement quantum annealing. In some implementations the quantum hardware can perform quantum annealing on an Ising model or restricted Ising model. The quantum hardware can receive data and instructions from the classical computing resource, and output data to the classical computing resource.”), 3:52-4:4 (“The computing resource 120 includes a totally corrective boosting with cardinality penalization engine 122 to receive data, e.g. training examples 104, and determine a linear combination of active weak classifiers 124, obtained from a dictionary of weak classifiers, that are strongly correlated with a true classification of the training examples. Each active weak classifier can be a feature of an overall set of features associated with a classification of data, e.g., a classification can be whether an email is spam or not, and a feature can identify that if the word ‘pills’ is in an email then the email is spam. The dictionary of weak classifiers can be constructed as a collection of decision stumps, each active weak classifier taking one of the original features. Additionally, the system determines a set of classifier weights w that identify a classifier weight for each determined active weak classifier in the linear combination of active weak classifiers 124. The set of classifier weights w can be stored by the system as a 32 or 64 bit floating point value. The computing resource 120 can then provide the client device 102 with the linear combination of active weak classifiers 124.”), 7:51-67 (“The set of classifier weights w is converted into discrete classifier weights {dot over (w)} that each have a specific bit depth, e.g., 1 bit, . . . , 8 bits, . . . , 12 bits, and so on. In some implementations the system can include quantum hardware, and optimizing the primal problem can be performed on the quantum hardware, discussed above with reference to FIG. 2. In these implementations the quantum hardware can have a specific amount of qubits available for use. The classifier weights, converted into discrete classifier weights, can then be mapped to the quantum hardware with a fixed amount of qubits. The system can receive the bit depth from a client, or in some implementations the system can determine a bit-depth, described below in step 514. In implementations where the system does not include quantum hardware, the system can implement a classical heuristic process to optimize the primal problem, e.g., a multi-start tabu search process.”)).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Ferreira and Hu to incorporate the teachings of Denchev to utilize quantum hardware to optimize the weights based on adiabatic annealing at least because doing so would enable generate good solutions more quickly. See Denchev 1:24-35.
Regarding claim 2, Ferreira, in view of Hu and Denchev, discloses the invention of claim 1 as discussed above. Ferreira further discloses training each classifier of the plurality of classifiers before performing the step of adjusting the weight values (Ferreira page 9 Algorithm 4 (the weak learners are trained before computing the weights of the final classifier)).
Regarding claim 7, Ferreira, in view of Hu and Denchev, discloses the invention of claim 1 as discussed above. Ferreira further discloses [a] boosted classifier comprising weight values and a plurality of classifiers, each classifier of the plurality of classifiers being associated with a weight value of the weight values, wherein the weight values have been adjusted by performing the method of claim 1 (Ferreira page 8 (“The AdaBoost algorithm is now a well known and deeply studied method to build ensembles of classifiers with very good performance [57]. The algorithm learns a set of classifiers, using a weak learner, in order to produce the final classifier of the form (3.1). The weak classifiers1 are obtained sequentially, using re-weighted versions of the training data, with the weights depending on the accuracy of the previous classifiers. The training set is always the same at each iteration, with each training instance weighted according to its (mis)classification by the previous classifiers. This allows the weak learner at each iteration to focus on patterns that were not well classified by the previous weak classifiers.”)).
Regarding claim 8, Ferreira, in view of Hu and Denchev, discloses the invention of claim 7 as discussed above. Ferreira does not expressly disclose the boosted classifier being a classifier for calculating whether data is indicative of an intrusion into at least one of: a network of computing devices, a computing device and a computing system (but see Hu, Weiming, Wei Hu, and Steve Maybank. "Adaboost-based algorithm for network intrusion detection." IEEE Transactions on Systems, Man, and Cybernetics, Part B (Cybernetics) 38.2 (2008): 577-583 Abstract (“—Network intrusion detection aims at distinguishing the attacks on the Internet from normal use of the Internet. It is an indispensable part of the information security system. Due to the variety of network behaviors and the rapid development of attack fashions, it is necessary to develop fast machine-learning-based intrusion detection algorithms with high detection rates and low false-alarm rates. In this correspondence, we propose an intrusion detection algorithm based on the AdaBoost algorithm. In the algorithm, decision stumps are used as weak classifiers. The decision rules are provided for both categorical and continuous features. By combining the weak classifiers for continuous features and the weak classifiers for categorical features into a strong classifier, the relations between these two different types of features are handled naturally, without any forced conversions between continuous and categorical features. Adaptable initial weights and a simple strategy for avoiding overfitting are adopted to improve the performance of the algorithm. Experimental results show that our algorithm has low computational complexity and error rates, as compared with algorithms of higher computational complexity, as tested on the benchmark sample data.”)).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Ferreira to incorporate the teachings of Hu to develop an intrusion detection algorithm based on the AdaBoost algorithm, at least because doing so would enable high detection rates and low false-alarm rates.
Regarding claim 9, Ferreira, in view of Hu and Denchev, discloses the invention of claim 8 as discussed above. Ferreira does not expressly disclose the boosted classifier being a classifier for calculating whether data is indicative of an intrusion involving at least one of:
unauthorized access to at least one of the network of computing devices, the computing device and the computing system, and (but see Hu Section I.A.a. (“Host- and network-based detections: As far as the data source is concerned, intrusion detection can be classified into host- and network-based detections [1]. Host-based approaches detect intrusions utilizing audit data that are collected from the target host machine.”))
misuse of at least one of the network of computing devices, the computing device and the computing system (but see Hu Section I.A.a. (“Network-based approaches detect intrusions using the IP package information collected by the network hardware such as switches and routers. Such information is not so abundant as the audit data of the target host machine.”)).
Ferreira and Hu are combinable for the same reasons as set forth earlier.
Regarding claim 11, Ferreira, in view of Hu and Denchev, discloses the invention of claim 7 as discussed above. Ferreira does not expressly disclose [c]alculating whether data is indicative of an intrusion into a computing entity by digitally executing the boosted classifier of claim 7 (but see Hu, Weiming, Wei Hu, and Steve Maybank. "Adaboost-based algorithm for network intrusion detection." IEEE Transactions on Systems, Man, and Cybernetics, Part B (Cybernetics) 38.2 (2008): 577-583 Abstract (“—Network intrusion detection aims at distinguishing the attacks on the Internet from normal use of the Internet. It is an indispensable part of the information security system. Due to the variety of network behaviors and the rapid development of attack fashions, it is necessary to develop fast machine-learning-based intrusion detection algorithms with high detection rates and low false-alarm rates. In this correspondence, we propose an intrusion detection algorithm based on the AdaBoost algorithm. In the algorithm, decision stumps are used as weak classifiers. The decision rules are provided for both categorical and continuous features. By combining the weak classifiers for continuous features and the weak classifiers for categorical features into a strong classifier, the relations between these two different types of features are handled naturally, without any forced conversions between continuous and categorical features. Adaptable initial weights and a simple strategy for avoiding overfitting are adopted to improve the performance of the algorithm. Experimental results show that our algorithm has low computational complexity and error rates, as compared with algorithms of higher computational complexity, as tested on the benchmark sample data.”)).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Ferreira to incorporate the teachings of Hu to develop an intrusion detection algorithm based on the AdaBoost algorithm, at least because doing so would enable high detection rates and low false-alarm rates.
Regarding claim 13, Ferreira, in view of Hu and Denchev, discloses the invention of claim 1 as discussed above. Ferreira does not expressly disclose [a] computing system or at least one computing device comprising means for carrying out the steps of the method of claim 1 (but see Hu Section V.C.2 (“Our AdaBoost-based algorithm is implemented on a Pentium IV computer with 2.6-GHz CPU and 256-MB RAM, using MATLAB 7.”)).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Ferreira to incorporate the teachings of Hu to implement the AdaBoost algorithm on a computer with memory, at least because doing so would enable performing network intrusion detection. See Hu Abstract.
Claim 3 is rejected under 35 U.S.C. 103 as being unpatentable over Ferreira, Hu, and Denchev as applied to claim 1 above, and further in view of Alzahrani, Abdulsalam O., and Mohammed JF Alenazi. "ML‐IDSDN: Machine learning based intrusion detection system for software‐defined network." Concurrency and Computation: Practice and Experience 35.1 (2023): e7438 (“Alzahrani”).
Regarding claim 3, Ferreira, in view of Hu and Denchev, discloses the invention of claim 1 as discussed above. Ferreira and Hu do not expressly disclose wherein the adjustment of the states of qubits is based on training data, the training data comprising sets of input data; (but see Denchev 4:62-5:9 (“In searching for a ground state for the global energy defined by a particular problem, adiabatic quantum annealing is applied. By defining a Hamiltonian for a problem to be solved and inputting the parameters of the Hamiltonian, a machine learning training system can use the chip to perform quantum annealing to reach a global ground state, at which point the chip outputs the state of each qubit 200, e.g., in the form of a bit string:
PNG
media_image2.png
62
484
media_image2.png
Greyscale
)).
Ferreira and Hu are combinable with Denchev for the same reasons as set forth above.
Ferreira does not expressly disclose:
each set of input data of the sets of input data being associated with output data indicative of whether the respective set of input data is indicative of an intrusion into a computing entity; each set of the sets of input data comprising at least one of: data indicative of a standard deviation of lengths of packets, data indicative of a total length of backward packets, data indicative of bytes of a backward subflow, data indicative of a destination port of packets and data indicative of a variance of lengths of packets (but see Alzahrani Summary (“Software-defined networking (SDN) has been developed to separate network control plane from forwarding plane which can decrease operational costs and the time it takes to deploy new services compared to traditional networks. Despite these advantages, this technology brings threats and vulnerabilities. Consequently, developing high-performance real-time intrusion detection systems (IDSs) to classify malicious activities is a vital part of SDN architecture. This article introduces two created datasets generated from SDN using Mininet and Ryu controller with different feature extraction tools that contain normal traffic and different types of attacks (Fin flood, UDPflood, ICMPflood, OSprobescan, portprobescan, TCP bandwidth flood, and TCP Syn flood) that is used for training a number of supervised binary classification machine learning algorithms such as k-nearest neighbor, AdaBoost, decision tree (DT), random forest, naive Bayes, multilayer perceptron, support vector machine, and XGBoost.”) pages 6-9 (listing features description and including std deviation of forward/backward packets, etc.)).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Ferreira and Hu to incorporate the teachings of Alzahrani to include packet features related to intrusion detection to train the AdaBoost classifier, at least because doing so would enable detection of network intrusion with high performance.
Claims 4-6 are rejected under 35 U.S.C. 103 as being unpatentable over Ferreira, Hu, and Denchev as applied to claim 1 above, and further in view of Zhao (US 11,531,841 B2; published Dec. 20, 2022).
Regarding claim 4, Ferreira, in view of Hu and Denchev, discloses the invention of claim 1 as discussed above. Ferreira does not expressly disclose: wherein the cost function at least comprises an error function with the error of A relative to B, where:
A is
PNG
media_image3.png
30
150
media_image3.png
Greyscale
, where
PNG
media_image4.png
28
22
media_image4.png
Greyscale
is a j-th set of data of a plurality of sets of input data;
PNG
media_image5.png
32
54
media_image5.png
Greyscale
is a classification, performed by the i-th classifier of the plurality of classifiers, of the j-th set of data of the plurality of sets of input data; and a is the weight value associated with the i-th classifier; B is an actual class of the j-th set of data of the plurality of sets of input data; and the error function being for all sets of data of the plurality of sets of input data or some sets of data of the plurality of sets of input data (but see Zhao ¶ 61 (“In an embodiment, the machine learning model may be iteratively trained for multiple times based on the sample and the corresponding second weight of the sample. Referring to FIG. 3, the machine learning model includes multiple classifiers. The multiple classifiers are base classifiers relative to the machine learning model, that is basic determining units, and are marked as y1(x) to ym(x). In this case, in an sth (s is an integer greater than or equal to 1) iterative training, the following operations are performed: the sample in the training set and the second weight w_xgb1 of the sample are inputted to each classifier, a minimum weighted error function (WEF) of each classifier is solved to obtain a fusion coefficient αm of the classifier, and the classifiers are combined based on the fusion coefficient of each classifier, to obtain the machine learning model after the sth iterative training. The model is shown in formula (2) and marked as:
PNG
media_image6.png
58
238
media_image6.png
Greyscale
”), ¶ 69 (“xi indicates a feature of an ith sample.
PNG
media_image7.png
70
138
media_image7.png
Greyscale
is a loss function, indicates a degree of a difference between a predicted value and an actual value of a target variable of a sample in the XGBoost model, and may be in a form of, for example, a quadratic loss function or an exponential loss function.
PNG
media_image8.png
78
94
media_image8.png
Greyscale
indicates a residual between a predicted value and an actual value of a target variable that is caused because of randomness of a sample, and is also referred to as a regularization term. The residual may be in a form of a sum of complexities of classification and regression trees in the classification and regression tree set. The regularization term is related to a quantity of leaf nodes and a value of the leaf node in the classification and regression tree.”)).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Ferreira and Hu to incorporate the teachings of Zhao to train the AdaBoost classifier based on a calculated residual between the predicted value and the actual value of a target variable, at least because doing so would enable training multiple classifiers in a supervised manner.
Regarding claim 5, Ferreira, in view of Hu and Denchev, discloses the invention of claim 1 as discussed above. Ferreira, Hu, and Denchev fail to expressly disclose:
computing a value of the cost function for the adjusted weight values,
determining whether the computed value of the cost function fulfills a criterion of convergence of the cost function, and
if the computed value of the cost function does not fulfill the criterion of convergence of the cost function, further performing the steps of:
adjusting the weight values…
computing a value of the cost function for the further adjusted weight values, thereby obtaining a further computed value of the cost function; and
determining whether the further computed value of the cost function fulfills the criterion of convergence of the cost function;
if the value of the cost function fulfills the criterion of convergence of the cost function, not performing the step of adjusting the weight values (but see Zhao ¶ 216 (“Iterative training ends after reaching a preset quantity of iterative training times. Alternatively, the target function shown in formula (4) and (5) is constructed for the binary classification warning model. Based on whether a value of the target function is less than a pre-determined value, it is determined whether an ideal fusion coefficient is obtained after each iterative training. When the value is not less than the pre-determined value, iterative training continues. When the value is less than the pre-determined value, the fusion coefficient is outputted, and the classifiers are combined according to the fusion coefficient, to obtain the trained binary classification warning model.”)).
Ferreira and Zhao are combinable for the same reasons as set forth above.
Ferreira and Hu do not expressly disclose adjusting the weight values by adjusting, by at least one quantum computing device, states of qubits for reducing a value of the cost function, thereby obtaining further adjusted weight values (but see Denchev 3:37-51 (“FIG. 1 is an illustration of an example system for determining a linear combination of active weak classifiers. The system includes a computing resource 120 that can include one or more classical computers, one or more software computing units executing in virtual machines on one or more computers, and is configured to execute a totally corrective boosting with cardinality penalization process. In some implementations the computing resource can include quantum optimization hardware, e.g., adiabatic quantum hardware that can implement quantum annealing. In some implementations the quantum hardware can perform quantum annealing on an Ising model or restricted Ising model. The quantum hardware can receive data and instructions from the classical computing resource, and output data to the classical computing resource.”), 3:52-4:4 (“The computing resource 120 includes a totally corrective boosting with cardinality penalization engine 122 to receive data, e.g. training examples 104, and determine a linear combination of active weak classifiers 124, obtained from a dictionary of weak classifiers, that are strongly correlated with a true classification of the training examples. Each active weak classifier can be a feature of an overall set of features associated with a classification of data, e.g., a classification can be whether an email is spam or not, and a feature can identify that if the word ‘pills’ is in an email then the email is spam. The dictionary of weak classifiers can be constructed as a collection of decision stumps, each active weak classifier taking one of the original features. Additionally, the system determines a set of classifier weights w that identify a classifier weight for each determined active weak classifier in the linear combination of active weak classifiers 124. The set of classifier weights w can be stored by the system as a 32 or 64 bit floating point value. The computing resource 120 can then provide the client device 102 with the linear combination of active weak classifiers 124.”), 7:51-67 (“The set of classifier weights w is converted into discrete classifier weights {dot over (w)} that each have a specific bit depth, e.g., 1 bit, . . . , 8 bits, . . . , 12 bits, and so on. In some implementations the system can include quantum hardware, and optimizing the primal problem can be performed on the quantum hardware, discussed above with reference to FIG. 2. In these implementations the quantum hardware can have a specific amount of qubits available for use. The classifier weights, converted into discrete classifier weights, can then be mapped to the quantum hardware with a fixed amount of qubits. The system can receive the bit depth from a client, or in some implementations the system can determine a bit-depth, described below in step 514. In implementations where the system does not include quantum hardware, the system can implement a classical heuristic process to optimize the primal problem, e.g., a multi-start tabu search process.”)).
Ferreira and Hu are combinable with Denchev for the same reasons as set forth above.
Regarding claim 6, Ferreira, in view of Hu and Denchev, discloses the invention of claim 5 as discussed above. Ferreira and Hu fail to expressly disclose wherein the computation of a value of the cost function is performed digitally (but see Denchev (US 11,620,573 B1; published Apr. 4, 2023) 3:37-51 (“FIG. 1 is an illustration of an example system for determining a linear combination of active weak classifiers. The system includes a computing resource 120 that can include one or more classical computers, one or more software computing units executing in virtual machines on one or more computers, and is configured to execute a totally corrective boosting with cardinality penalization process. In some implementations the computing resource can include quantum optimization hardware, e.g., adiabatic quantum hardware that can implement quantum annealing. In some implementations the quantum hardware can perform quantum annealing on an Ising model or restricted Ising model. The quantum hardware can receive data and instructions from the classical computing resource, and output data to the classical computing resource.”), 3:52-4:4 (“The computing resource 120 includes a totally corrective boosting with cardinality penalization engine 122 to receive data, e.g. training examples 104, and determine a linear combination of active weak classifiers 124, obtained from a dictionary of weak classifiers, that are strongly correlated with a true classification of the training examples. Each active weak classifier can be a feature of an overall set of features associated with a classification of data, e.g., a classification can be whether an email is spam or not, and a feature can identify that if the word ‘pills’ is in an email then the email is spam. The dictionary of weak classifiers can be constructed as a collection of decision stumps, each active weak classifier taking one of the original features. Additionally, the system determines a set of classifier weights w that identify a classifier weight for each determined active weak classifier in the linear combination of active weak classifiers 124. The set of classifier weights w can be stored by the system as a 32 or 64 bit floating point value. The computing resource 120 can then provide the client device 102 with the linear combination of active weak classifiers 124.”)).
Ferreira and Hu are combinable with Denchev for the same reasons as set forth above.
Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over Ferreira, Hu, and Denchev as applied to claim 9 above, and further in view of Billhartz (US 2004/0028016 A1; published Feb. 12, 2004).
Regarding claim 10, Ferreira, in view of Hu and Denchev, discloses the invention of claim 9 as discussed above. Ferreira and Hu do not expressly disclose wherein the misuse of the network of computing devices comprises modifying a configuration of the network of computing devices (but see Billhartz ¶ 6 (“Some approaches are now being developed for providing intrusion detection in mobile ad-hoc networks. One such approach is outlined in an article by Zhang et al. entitled "Intrusion Detection in Wireless Ad-Hoc Networks," ACM MOBICOM, 2000. In this article, an intrusion detection architecture is proposed in which every node in the MANET participates in intrusion detection and response. That is, each node is responsible for detecting signs of intrusion locally and independently, but neighboring nodes can collaboratively investigate in a broader range. Moreover, intrusion detection is based upon anomaly detections, such as the detection of abnormal updates to routing tables or anomalies in certain network layers, such as with media access control (MAC) layer protocols.”)).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Ferreira, Hu, and Denchev to incorporate the teachings of Billhartz to utilize the AdaBoost algorithm for detecting unauthorized changes to routing tables, at least because doing so would enable taking countermeasures to respond to the unauthorized intrusion. See Billhartz ¶ 46.
Claim 12 is rejected under 35 U.S.C. 103 as being unpatentable over Ferreira, Hu, and Denchev as applied to claim 11 above, and further in view of Litichever (US 2020/0389469 A1; published Dec. 10, 2020).
Regarding claim 12, Ferreira, in view of Hu and Denchev, discloses the invention of claim 11 as discussed above. Ferreira does not expressly disclose [c]alculating whether data is indicative of an intrusion according to claim 11, and, upon calculating that data is indicative of an intrusion into a computing entity, performing at least one of:
generating a signal indicative of an intrusion,
blocking traffic of a network of computing devices, the network being associated with the data classified as indicative of an intrusion by the boosted classifier, and
isolating a computing device, the computing device being associated with the data classified as indicative of an intrusion by the boosted classifier (but see Litichever ¶ 600 (“In the case the criterion applied as part of the analysis in the “Analyze Message” step 93, suggests a malware presence (or any other anomaly or configuration change), suggesting possible or certain intrusion to the network as determined as part of the “Suspected?” step 94, various actions may be taken as part of a “Take Action” step 96. As part of the action taken as part of the “Take Action” step 96, a record regarding the incident may be stored in the memory, for logging the analyzer server 81 activity and results, as part of a “LOG” step 96a. Alternatively or in addition, a person or a device may be notified of the suspected attack or intrusion as part of a “Notify User” step 96b, that may include activating or controlling the annunciator 84 by the processor. In a case where a frame or packet that may be affected or generated as part of an attack, the analyzer server 81 may transmit in parallel to the receiving of the frame or packet, a signal to the medium of the protected network 41, such as a frame or packet, forming a collision on the medium, thus neutralizing the unauthorized effect or propagation of the frame or packet, causing the other devices in the network to ignore the suspected frame or packet. As part of a “Transmit Notification” step 96d, the detection of an attack may result in a transmission of a message, or blocking a transmission of a message, to the protected network 41. As part of a “Block” step 96c, any further data or message from the suspected device that transmitted the suspected message is blocked by the system, thus affectively isolating the device from the protected network 41 for avoiding or minimizing any further harm or impact.”)).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Ferreira, Hu, and Denchev, to incorporate the teachings of Litichever to notify of an intrusion, block further messages from the suspected device, and isolate the device from the protected network, at least because doing so would avoid or minimize any further harm or impact. Litichever ¶ 600.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Norris et al. Detection of Softswitch Attacks (US 7,412,722 B1; published Aug. 12, 2008)
Wiebe et al., Adversarial Quantum Machine Learning (US 2018/0349605 A1; published Dec. 6, 2018)
Adachi, Steven H., and Maxwell P. Henderson. "Application of quantum annealing to training of deep neural networks." arXiv preprint arXiv:1510.06356 (2015)
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHAHID KHAN whose telephone number is (571)270-0419. The examiner can normally be reached M-F, 9-5 est.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Usmaan Saeed can be reached at (571)272-4046. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SHAHID K KHAN/ Primary Examiner, Art Unit 2146
Prosecution Insights